CVE-2021-33704
- State
- Published
- Severity
- 6.3 Medium
- Published
- Sep 15, 2021
- Updated
- Aug 3, 2024
- Reserved
- May 28, 2021
Description
The Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions that would otherwise be restricted to specific users. For an attacker to discover the vulnerable function, no in-depth system knowledge is required. Once exploited via Network stack, the attacker may be able to read, modify or delete restricted data. The impact is that missing authorization can result of abuse of functionality usually restricted to specific users.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | sap |
Weaknesses
- CWE-862 Missing Authorization Check
Affected Products
| Product | Versions |
|---|---|
SAP Business OneSAP SE |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.