Authorization Vulnerability in SAP's HCM Travel Management Fiori Apps
CVE-2021-27605

4.3MEDIUM

Key Information:

Vendor
SAP
Status
SAP Fiori Apps 2.0 For Travel Management In SAP Erp
Vendor
CVE Published:
13 April 2021

Summary

A vulnerability in SAP's HCM Travel Management Fiori Apps V2, version 608, allows an authenticated but unauthorized individual to access sensitive personnel information, such as employee names. This results from inadequate authorization checks within the application. While the affected party can view limited details, it poses a risk to user privacy by exposing sensitive employee data. The application's integrity and availability remain unaffected, but the potential for privilege escalation highlights the need for prompt remediation.

Affected Version(s)

SAP Fiori Apps 2.0 for Travel Management in SAP ERP < 608

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/3025054
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.