CVE-2021-33704
Last modified
CVE-2021-33704 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. The Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions that would otherwise be restricted to specific users. For an attacker to discover the vulnerable function, no in-depth system knowledge is required. EPSS estimates a 0.59% chance of exploitation in the next 30 days.
Description
The Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions that would otherwise be restricted to specific users. For an attacker to discover the vulnerable function, no in-depth system knowledge is required. Once exploited via Network stack, the attacker may be able to read, modify or delete restricted data. The impact is that missing authorization can result of abuse of functionality usually restricted to specific users.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sap | Business One | 10.0 |
References
- https://launchpad.support.sap.com/#/notes/3078072Permissions Required
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806Patch, Vendor Advisory
- https://launchpad.support.sap.com/#/notes/3078072Permissions Required
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-33704?
How severe is CVE-2021-33704?
How do I fix CVE-2021-33704?
Are you affected by CVE-2021-33704?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST