CVE-2021-33704
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions that would otherwise be restricted to specific users. For an attacker to discover the vulnerable function, no in-depth system knowledge is required. Once exploited via Network stack, the attacker may be able to read, modify or delete restricted data. The impact is that missing authorization can result of abuse of functionality usually restricted to specific users.
La Capa de Servicio de SAP Business One, versión - 10.0, permite a un atacante autenticado invocar determinadas funciones que de otra manera estarían restringidas a usuarios específicos. Para que un atacante detecte la función vulnerable, no es requerido un conocimiento profundo del sistema. Una vez explotada por medio de la pila de red, el atacante puede ser capaz de leer, modificar o borrar datos restringidos. El impacto es que la falta de autorización puede resultar en un abuso de la funcionalidad normalmente restringida a usuarios específicos
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-05-28 CVE Reserved
- 2021-09-15 CVE Published
- 2023-04-08 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-862: Missing Authorization
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806 | 2021-09-28 |
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Sap Search vendor "Sap" | Business One Search vendor "Sap" for product "Business One" | 10.0 Search vendor "Sap" for product "Business One" and version "10.0" | - |
Affected
|