CVE-2021-40498

Severity Score

5.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A vulnerability has been identified in SAP SuccessFactors Mobile Application for Android - versions older than 2108, which allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service, which can lead to denial of service. The vulnerability is related to Android implementation methods that are widely used across Android mobile applications, and such methods are embedded into the SAP SuccessFactors mobile application. These Android methods begin executing once the user accesses their profile on the mobile application. While executing, it can also pick up the activities from other Android applications that are running in the background of the users device and are using the same types of methods in the application. Such vulnerability can also lead to phishing attacks that can be used for staging other types of attacks.

Se ha identificado una vulnerabilidad en SAP SuccessFactors Mobile Application para Android - versiones anteriores a la 2108, que permite a un atacante impedir que los usuarios legítimos accedan a un servicio, ya sea al bloquear o inundar el servicio, lo que puede conllevar a una denegación de servicio. La vulnerabilidad está relacionada con los métodos de implementación de Android que se usan ampliamente en las aplicaciones móviles de Android, y dichos métodos están insertados en la aplicación móvil de SAP SuccessFactors. Estos métodos de Android comienzan a ejecutarse una vez que el usuario accede a su perfil en la aplicación móvil. Mientras se ejecutan, también pueden recoger las actividades de otras aplicaciones Android que se están ejecutando en segundo plano en el dispositivo del usuario y que están usando los mismos tipos de métodos en la aplicación. Esta vulnerabilidad también puede conllevar a ataques de phishing que pueden ser usados para realizar otros tipos de ataques

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-09-03 CVE Reserved
2021-10-12 CVE Published
2023-05-05 EPSS Updated
2024-08-04 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983	2021-10-18

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Sap Search vendor "Sap"		Successfactors Mobile Search vendor "Sap" for product "Successfactors Mobile"				< 2108 Search vendor "Sap" for product "Successfactors Mobile" and version " < 2108"		android		Affected