Lucene search

[email protected]CVE-2021-44232

HistoryDec 14, 2021 - 4:15 p.m.

CVE-2021-44232

2021-12-1416:15:09

CWE-22

[email protected]

web.nvd.nist.gov

nvd

cve-2021-44232

saf-t framework

transaction

directory access

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

7.7 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.0%

JSON

SAF-T Framework Transaction SAFTN_G allows an attacker to exploit insufficient validation of path information provided by normal user, leading to full server directory access. The attacker can see the whole filesystem structure but cannot overwrite, delete, or corrupt arbitrary files on the server.

Affected configurations

NVD

Node

sapsaf-t_frameworkMatch103

sapsaf-t_frameworkMatch104

sapsaf-t_frameworkMatch105

sapsaf-t_frameworkMatch602

sapsaf-t_frameworkMatch603

sapsaf-t_frameworkMatch604

sapsaf-t_frameworkMatch605

sapsaf-t_frameworkMatch606

sapsaf-t_frameworkMatch618

sapsaf-t_frameworkMatch720

sapsaf-t_frameworkMatch730

sapsaf-t_frameworkMatchs4core_102

sapsaf-t_frameworkMatchsap_appl_600

sapsaf-t_frameworkMatchsap_fin_617

CPENameOperatorVersion
sap:saf-t_frameworksap saf-t frameworkeq103
sap:saf-t_frameworksap saf-t frameworkeq104
sap:saf-t_frameworksap saf-t frameworkeq105
sap:saf-t_frameworksap saf-t frameworkeq602
sap:saf-t_frameworksap saf-t frameworkeq603
sap:saf-t_frameworksap saf-t frameworkeq604
sap:saf-t_frameworksap saf-t frameworkeq605
sap:saf-t_frameworksap saf-t frameworkeq606
sap:saf-t_frameworksap saf-t frameworkeq618
sap:saf-t_frameworksap saf-t frameworkeq720

CPE	Name	Operator	Version
sap:saf-t_framework	sap saf-t framework	eq	103
sap:saf-t_framework	sap saf-t framework	eq	104
sap:saf-t_framework	sap saf-t framework	eq	105
sap:saf-t_framework	sap saf-t framework	eq	602
sap:saf-t_framework	sap saf-t framework	eq	603
sap:saf-t_framework	sap saf-t framework	eq	604
sap:saf-t_framework	sap saf-t framework	eq	605
sap:saf-t_framework	sap saf-t framework	eq	606
sap:saf-t_framework	sap saf-t framework	eq	618
sap:saf-t_framework	sap saf-t framework	eq	720

Rows per page:

1-10 of 141

CNA Affected

[
  {
    "product": "SAF-T Framework",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< SAP_FIN 617"
      },
      {
        "status": "affected",
        "version": "< 618"
      },
      {
        "status": "affected",
        "version": "< 720"
      },
      {
        "status": "affected",
        "version": "< 730"
      },
      {
        "status": "affected",
        "version": "< SAP_APPL 600"
      },
      {
        "status": "affected",
        "version": "< 602"
      },
      {
        "status": "affected",
        "version": "< 603"
      },
      {
        "status": "affected",
        "version": "< 604"
      },
      {
        "status": "affected",
        "version": "< 605"
      },
      {
        "status": "affected",
        "version": "< 606"
      },
      {
        "status": "affected",
        "version": "< S4CORE 102"
      },
      {
        "status": "affected",
        "version": "< 103"
      },
      {
        "status": "affected",
        "version": "< 104"
      },
      {
        "status": "affected",
        "version": "< 105"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/3124094

wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

7.7 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.0%

JSON

Related for CVE-2021-44232

prion1 cvelist1 nvd1