CVE-2021-27605
Medium
Description
SAP's HCM Travel Management Fiori Apps V2, version - 608, does not perform proper authorization check, allowing an authenticated but unauthorized attacker to read personnel numbers of employees, resulting in escalation of privileges. However, the attacker can only read some information like last name, first name of the employees, so there is some loss of confidential information, Integrity and Availability are not impacted.
SeverityMedium
CVSS4.3
Exploit probability—
Product
Fiori Apps 2.0 For Travel Management In Sap Erp
PublishedApr 13, 2021
First seenApr 13, 2021
How to fix
Update
- sap fiori_apps_2.0_for_travel_management_in_sap_erp608 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sap fiori_apps_2.0_for_travel_management_in_sap_erp | v < 608 | 608 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.