fkie_cve-2021-44232
Vulnerability from fkie_nvd
Published
2021-12-14 16:15
Modified
2024-11-21 06:30
Severity ?
7.7 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Summary
SAF-T Framework Transaction SAFTN_G allows an attacker to exploit insufficient validation of path information provided by normal user, leading to full server directory access. The attacker can see the whole filesystem structure but cannot overwrite, delete, or corrupt arbitrary files on the server.
References
cna@sap.comhttps://launchpad.support.sap.com/#/notes/3124094Vendor Advisory
cna@sap.comhttps://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021Permissions Required, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://launchpad.support.sap.com/#/notes/3124094Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021Permissions Required, Vendor Advisory
Impacted products
Vendor Product Version
sap saf-t_framework 103
sap saf-t_framework 104
sap saf-t_framework 105
sap saf-t_framework 602
sap saf-t_framework 603
sap saf-t_framework 604
sap saf-t_framework 605
sap saf-t_framework 606
sap saf-t_framework 618
sap saf-t_framework 720
sap saf-t_framework 730
sap saf-t_framework s4core_102
sap saf-t_framework sap_appl_600
sap saf-t_framework sap_fin_617


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:saf-t_framework:103:*:*:*:*:*:*:*",
              "matchCriteriaId": "075F0C13-743C-4989-8E9F-9556C627B7F2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:saf-t_framework:104:*:*:*:*:*:*:*",
              "matchCriteriaId": "EC128E0D-BC7A-4BBB-9CF7-5C487B78637B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:saf-t_framework:105:*:*:*:*:*:*:*",
              "matchCriteriaId": "1BD00FEF-63F3-43C0-BEC1-7A90C48D403E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:saf-t_framework:602:*:*:*:*:*:*:*",
              "matchCriteriaId": "49BAD4FA-0687-4CFC-AD49-76CAAABEAC0F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:saf-t_framework:603:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF9E5BB1-C617-4E31-9BF7-E15CA1A72708",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:saf-t_framework:604:*:*:*:*:*:*:*",
              "matchCriteriaId": "E5CAB262-D04E-4382-8907-4524A1A45841",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:saf-t_framework:605:*:*:*:*:*:*:*",
              "matchCriteriaId": "E172D844-43B3-4215-8FA4-38432AE7468C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:saf-t_framework:606:*:*:*:*:*:*:*",
              "matchCriteriaId": "572EC58C-FD48-4020-9DAE-A36458AA3AF0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:saf-t_framework:618:*:*:*:*:*:*:*",
              "matchCriteriaId": "14947511-CDD0-470E-A80D-46BA8FCC6176",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:saf-t_framework:720:*:*:*:*:*:*:*",
              "matchCriteriaId": "ECDD7553-5E2A-4D21-A042-C1AA40707E3D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:saf-t_framework:730:*:*:*:*:*:*:*",
              "matchCriteriaId": "12B61A0B-9894-403A-ACA3-1E3781922B0D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:saf-t_framework:s4core_102:*:*:*:*:*:*:*",
              "matchCriteriaId": "0EB72F03-0FE0-46E8-A306-AAB6D39BF1FE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:saf-t_framework:sap_appl_600:*:*:*:*:*:*:*",
              "matchCriteriaId": "C97C61FF-F3DE-4FCE-B13D-2189896AAAFA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:saf-t_framework:sap_fin_617:*:*:*:*:*:*:*",
              "matchCriteriaId": "4F697A32-AF79-4A85-974A-AADB19F4E5B6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAF-T Framework Transaction SAFTN_G allows an attacker to exploit insufficient validation of path information provided by normal user, leading to full server directory access. The attacker can see the whole filesystem structure but cannot overwrite, delete, or corrupt arbitrary files on the server."
    },
    {
      "lang": "es",
      "value": "SAF-T Framework Transaction SAFTN_G permite a un atacante explotar una comprobaci\u00f3n insuficiente de la informaci\u00f3n de la ruta proporcionada por el usuario normal, conllevando a un acceso completo al directorio del servidor. El atacante puede ver toda la estructura del sistema de archivos pero no puede sobrescribir, borrar o corromper archivos arbitrarios en el servidor"
    }
  ],
  "id": "CVE-2021-44232",
  "lastModified": "2024-11-21T06:30:38.860",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 4.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-12-14T16:15:09.623",
  "references": [
    {
      "source": "cna@sap.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/3124094"
    },
    {
      "source": "cna@sap.com",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "url": "https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/3124094"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "url": "https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021"
    }
  ],
  "sourceIdentifier": "cna@sap.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.