QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2021-27605

Back to search

CVE-2021-27605

Published: Apr 13, 2021

Modified: Aug 3, 2024

PUBLISHED

CVSS v3.0

4.3

MEDIUM

Description

SAP's HCM Travel Management Fiori Apps V2, version - 608, does not perform proper authorization check, allowing an authenticated but unauthorized attacker to read personnel numbers of employees, resulting in escalation of privileges. However, the attacker can only read some information like last name, first name of the employees, so there is some loss of confidential information, Integrity and Availability are not impacted.

VendorProductVersions

SAP SE

SAP Fiori Apps 2.0 for Travel Management in SAP ERP

affected
< 608

CVSS v3.0 Details

CVSS v3.0 Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now