CVE-2021-27610

Estado: ModificadaCrítica (9.8)—
SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804, does not create information about internal and external RFC user in consistent and distinguished format, which could lead to improper authentication and may be exploited by malicious users to obtain illegitimate access to the system.
CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 9.8
Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 1.32%
Percentil entre todas las CVEs puntuadas: 70
Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)

SAP — Netweaver Abap SAP — Netweaver Application Server Abap
CWE

CWE-287
Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-27610",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.2
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAP NetWeaver AS ABAP and ABAP Platform",
          "versions": [
            {
              "status": "affected",
              "version": "< 700"
            },
            {
              "status": "affected",
              "version": "< 701"
            },
            {
              "status": "affected",
              "version": "< 702"
            },
            {
              "status": "affected",
              "version": "< 731"
            },
            {
              "status": "affected",
              "version": "< 740"
            },
            {
              "status": "affected",
              "version": "< 750"
            },
            {
              "status": "affected",
              "version": "< 751"
            },
            {
              "status": "affected",
              "version": "< 752"
            },
            {
              "status": "affected",
              "version": "< 753"
            },
            {
              "status": "affected",
              "version": "< 754"
            },
            {
              "status": "affected",
              "version": "< 755"
            },
            {
              "status": "affected",
              "version": "< 804"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-06-16T15:15:08.363",
  "references": [
    {
      "url": "https://launchpad.support.sap.com/#/notes/3007182",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/3007182",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804, does not create information about internal and external RFC user in consistent and distinguished format, which could lead to improper authentication and may be exploited by malicious users to obtain illegitimate access to the system."
    },
    {
      "lang": "es",
      "value": "SAP NetWeaver ABAP Server y ABAP Platform, versiones - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804, no crea información sobre el usuario RFC interno y externo en un formato consistente y distinguible, lo que podría conllevar a una autenticación inapropiada y podría ser explotado por usuarios maliciosos para obtener acceso ilegítimo al sistema"
    }
  ],
  "lastModified": "2026-06-17T03:45:13.550",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:netweaver_abap:700:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E0DA7CC6-A0F6-4839-965D-C60F691496AD"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_abap:701:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6497854E-9C7B-4DAF-ADC6-F26523BB7D47"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_abap:702:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FFC58754-3A9D-4320-AB4F-385FB72608E7"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_abap:731:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5B8A73A5-4526-40E1-A540-0A6C3F93DA05"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_abap:740:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "09A38B6E-03DC-4086-A307-542B35814E0E"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_abap:750:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4651257F-7BFC-41AE-8E37-8C96F822CE58"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_abap:751:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EECB438D-D5CD-4483-934F-4C814A725A35"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_abap:752:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "14A1CD95-14E1-438A-92FB-A0E47A88C59F"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_abap:753:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4148303B-133A-4FD2-B546-DD86C5D0E7C1"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_abap:754:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E51EF6BC-4C1C-4F1B-9873-D571BE3788F5"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_abap:755:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "424A3D68-0825-4A2C-BEB1-DC9A212A5E42"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_abap:804:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5EFD3BCC-9B3E-49F2-B469-C465381303B4"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5A3C915-0E5F-4B1A-B1EB-5ADEA517F620"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:701:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "98B2522A-B850-4EC2-B2F2-5EBF36801B39"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:702:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "706FEB9E-3EE9-405E-A8C9-733DAF68AC6D"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:731:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5CC29738-CF17-4E6B-9C9E-879B17F7E001"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "127E508F-6CC1-41C8-96DF-8D14FFDD4020"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7777AA80-1608-420E-B7D5-09ABECD51728"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:751:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0539618A-1C4D-463F-B2BB-DD1C239C23EB"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:752:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "62828DCD-F80E-4C7C-A988-EFEA06A5223E"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:753:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D9F38585-73AE-4DBB-A978-F0272DF8FB58"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:754:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D416C064-BB8A-4230-A761-84A93E017F79"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:755:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6B8D3EA0-28E6-4333-8C67-B9D3775EB9BC"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:804:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2132C1C0-AD61-4C85-BA07-523206815A4D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}