CVE-2021-21473

MEDIUM

SAP NetWeaver AS ABAP and ABAP Platform - Missing Authorization in SRM_RFC_SUBMIT_REPORT Function Module

Title source: llm

Description

SAP NetWeaver AS ABAP and ABAP Platform, versions - 700, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, contains function module SRM_RFC_SUBMIT_REPORT which fails to validate authorization of an authenticated user thus allowing an unauthorized user to execute reports in SAP NetWeaver ABAP Platform.

References (4)

Core 4

Core References

Vendor Advisory x_refsource_misc

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999

Permissions Required, Vendor Advisory x_refsource_misc

https://launchpad.support.sap.com/#/notes/3002517

Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2022/May/42

Exploit, Third Party Advisory, VDB Entry x_refsource_misc

http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html

Scores

CVSS v3 6.3

EPSS 0.0047

EPSS Percentile 65.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Details

CWE

CWE-862

Status published

Products (13)

sap/netweaver_application_server_abap 700

sap/netweaver_application_server_abap 702

sap/netweaver_application_server_abap 710

sap/netweaver_application_server_abap 711

sap/netweaver_application_server_abap 730

sap/netweaver_application_server_abap 731

sap/netweaver_application_server_abap 740

sap/netweaver_application_server_abap 750

sap/netweaver_application_server_abap 751

sap/netweaver_application_server_abap 752

... and 3 more

Published Jun 09, 2021

Tracked Since Feb 18, 2026