Vulnerabilities > CVE-2021-21473 - Missing Authorization vulnerability in SAP Netweaver Application Server Abap

CVSS 6.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

LOW

Integrity impact

LOW

Availability impact

LOW

network

low complexity

sap

CWE-862

NVD

Published: 2021-06-09

Updated: 2022-10-05

Summary

SAP NetWeaver AS ABAP and ABAP Platform, versions - 700, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, contains function module SRM_RFC_SUBMIT_REPORT which fails to validate authorization of an authenticated user thus allowing an unauthorized user to execute reports in SAP NetWeaver ABAP Platform.

Vulnerable Configurations

Part	Description	Count
Application	Sap SAP Netweaver Application Server Abap 702 SAP Netweaver Application Server Abap 750 SAP Netweaver Application Server Abap 752 SAP Netweaver Application Server Abap 753 SAP Netweaver Application Server Abap 754 SAP Netweaver Application Server Abap 755 SAP Netweaver Application Server Abap 700 SAP Netweaver Application Server Abap 710 SAP Netweaver Application Server Abap 730 SAP Netweaver Application Server Abap 731 SAP Netweaver Application Server Abap 711 SAP Netweaver Application Server Abap 740 SAP Netweaver Application Server Abap 751	13

Common Weakness Enumeration (CWE)

CWE-862 - Missing Authorization

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References