CVE-2021-40496

Опубликовано: 12 окт. 2021

Источник: nvd

CVSS3: 4.3

CVSS2: 4

EPSS Низкий

Описание

SAP Internet Communication framework (ICM) - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785, allows an attacker with logon functionality, to exploit the authentication function by using POST and form field to repeat executions of the initial command by a GET request and exposing sensitive data. This vulnerability is normally exposed over the network and successful exploitation can lead to exposure of data like system details.

Ссылки

https://launchpad.support.sap.com/#/notes/3087254
Permissions Required
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983
Vendor Advisory
https://launchpad.support.sap.com/#/notes/3087254
Permissions Required
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:sap:netweaver_abap:700:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_abap:701:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_abap:702:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_abap:730:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_abap:731:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_abap:740:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_abap:750:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_abap:751:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_abap:752:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_abap:753:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_abap:754:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_abap:755:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_abap:756:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_abap:785:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_application_server_abap:701:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_application_server_abap:702:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_application_server_abap:730:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_application_server_abap:731:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_application_server_abap:751:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_application_server_abap:752:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_application_server_abap:753:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_application_server_abap:754:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_application_server_abap:755:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_application_server_abap:756:*:*:*:*:*:*:*

cpe:2.3:a:sap:netweaver_application_server_abap:785:*:*:*:*:*:*:*

EPSS

Процентиль: 61%

0.00416

Низкий

4.3 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-668

Связанные уязвимости

GHSA-chrv-p5rc-j7c8