Lucene search

SapCVELIST:CVE-2021-33689

HistoryJul 14, 2021 - 11:04 a.m.

CVE-2021-33689

2021-07-1411:04:38

CWE-778

sap

www.cve.org

sap netweaver

security audit log

insufficient privileges

CVSS3

3.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

When user with insufficient privileges tries to access any application in SAP NetWeaver Administrator (Administrator applications), version - 7.50, no security audit log is created. Therefore, security audit log Integrity is impacted.

CNA Affected

[
  {
    "product": "SAP NetWeaver AS JAVA (Administrator applications)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 7.50"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/3038594

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506

CVSS3

3.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

Related for CVELIST:CVE-2021-33689