« Volver al listado

CVE-2021-33676

Estado: ModificadaAlta (7.2)—

A missing authority check in SAP CRM, versions - 700, 701, 702, 712, 713, 714, could be leveraged by an attacker with high privileges to compromise confidentiality, integrity, or availability of the system.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — Customer Relationship Management

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-33676",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.9
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAP CRM",
          "versions": [
            {
              "status": "affected",
              "version": "< 700"
            },
            {
              "status": "affected",
              "version": "< 701"
            },
            {
              "status": "affected",
              "version": "< 702"
            },
            {
              "status": "affected",
              "version": "< 712"
            },
            {
              "status": "affected",
              "version": "< 713"
            },
            {
              "status": "affected",
              "version": "< 714"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-07-14T12:15:08.307",
  "references": [
    {
      "url": "https://launchpad.support.sap.com/#/notes/3066316",
      "tags": [
        "Permissions Required"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/3066316",
      "tags": [
        "Permissions Required"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A missing authority check in SAP CRM, versions - 700, 701, 702, 712, 713, 714, could be leveraged by an attacker with high privileges to compromise confidentiality, integrity, or availability of the system."
    },
    {
      "lang": "es",
      "value": "Una falta de comprobación de autoridad en SAP CRM, versiones - 700, 701, 702, 712, 713, 714, podría ser aprovechada por un atacante con altos privilegios para comprometer la confidencialidad, integridad o disponibilidad del sistema"
    }
  ],
  "lastModified": "2026-06-17T03:55:00.703",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:customer_relationship_management:700:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "082053C1-23F5-43E1-B2FD-5ECDE3EFC101"
            },
            {
              "criteria": "cpe:2.3:a:sap:customer_relationship_management:701:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1827CD2E-82B5-4D80-B606-ECEA9977905E"
            },
            {
              "criteria": "cpe:2.3:a:sap:customer_relationship_management:702:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "33C39D15-9A98-4051-A086-A08EB3E3776D"
            },
            {
              "criteria": "cpe:2.3:a:sap:customer_relationship_management:712:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1E6F69C1-E6CD-4B48-BE75-66BC355EA643"
            },
            {
              "criteria": "cpe:2.3:a:sap:customer_relationship_management:713:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "69E8FBB3-92C7-4B2A-8A4E-E30EB6B64F7C"
            },
            {
              "criteria": "cpe:2.3:a:sap:customer_relationship_management:714:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "93135E4D-F522-4A0C-9580-DBF6FC51931A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}