Privilege Escalation Vulnerability in SAP NetWeaver Guided Procedures
CVE-2021-33671

7.6HIGH

Key Information:

Vendor
SAP
Status
SAP Netweaver Guided Procedures (administration Workset)
Vendor
CVE Published:
14 July 2021

Summary

SAP NetWeaver Guided Procedures across multiple versions fail to implement essential authorization checks for authenticated users. This oversight allows users to escalate their privileges, potentially leading to unauthorized access to functionalities and data meant solely for specific user groups. The lack of robust permission verification can result in unauthorized users being able to read, modify, or even delete sensitive restricted data, posing significant security risks.

Affected Version(s)

SAP NetWeaver Guided Procedures (Administration Workset) < 7.10 < 7.10

SAP NetWeaver Guided Procedures (Administration Workset) < 7.20 < 7.20

SAP NetWeaver Guided Procedures (Administration Workset) < 7.30 < 7.30

References

https://launchpad.support.sap.com/#/notes/3059446
x_refsource_MISC
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.