« Volver al listado

CVE-2021-44233

Estado: ModificadaAlta (8.8)—

SAP GRC Access Control - versions V1100_700, V1100_731, V1200_750, does not perform necessary authorization checks for an authenticated user, which could lead to escalation of privileges.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — Access Control

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-44233",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAP GRC Access Control",
          "versions": [
            {
              "status": "affected",
              "version": "< V1100_700"
            },
            {
              "status": "affected",
              "version": "< V1100_731"
            },
            {
              "status": "affected",
              "version": "< V1200_750"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-12-14T16:15:09.663",
  "references": [
    {
      "url": "https://launchpad.support.sap.com/#/notes/3080816",
      "tags": [
        "Permissions Required"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/3080816",
      "tags": [
        "Permissions Required"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP GRC Access Control - versions V1100_700, V1100_731, V1200_750, does not perform necessary authorization checks for an authenticated user, which could lead to escalation of privileges."
    },
    {
      "lang": "es",
      "value": "SAP GRC Access Control - versiones V1100_700, V1100_731, V1200_750, no lleva a cabo las comprobaciones de autorización necesarias para un usuario autenticado, lo que podría conllevar a una escalada de privilegios"
    }
  ],
  "lastModified": "2026-06-17T04:12:06.263",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:access_control:v1100_700:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "53121FB8-B429-450B-842C-AA23CD7B58F2"
            },
            {
              "criteria": "cpe:2.3:a:sap:access_control:v1100_731:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6E8AE08C-13B4-4D3A-ABBF-2BC5BFC9EDF7"
            },
            {
              "criteria": "cpe:2.3:a:sap:access_control:v1200_750:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B0D339D6-D70E-4BEA-AF13-D39CECA5EFD4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}