CVE-2021-38164 Missing authorization in SAP ERP Financial Accounting (RFOPENPOSTING FR)
A registered attacker can invoke restricted functions to view and modify financial accounting data in SAP ERP.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-38164?
CVE-2021-38164 is a medium-severity missing authorization vulnerability in SAP ERP Financial Accounting (RFOPENPOSTING_FR), published on 14 Sep 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SAP ERP Financial Accounting (RFOPENPOSTING_FR) versions - SAP_APPL - 600, 602, 603, 604, 605, 606, 616, SAP_FIN - 617, 618, 700, 720, 730, SAPSCORE - 125, S4CORE, 100, 101, 102, 103, 104, 105, allows a registered attacker to invoke certain functions that would otherwise be restricted to specific users. These functions are normally exposed over the network and once exploited the attacker may be able to view and modify financial accounting data that only a specific user should have access to.
Weakness: CWE-862
Which versions are affected by CVE-2021-38164?
It affects 1 product.
Products include Sap Erp Financial Accounting.
How do I fix CVE-2021-38164?
No fix has been published for CVE-2021-38164 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-38164 being exploited?
There is no known exploitation of CVE-2021-38164 in the wild and no public exploit code.
Other vulnerabilities in SAP ERP Financial Accounting (RFOPENPOSTING_FR)
Sources
Also known as GHSA-hfg4-62f6-fjff.