CVE-2021-38179 Information disclosure in SAP Business One
An admin user can view captured packet contents including credentials due to a debug function enabled by default in the SAP Business One Integration Admin UI.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-38179?
CVE-2021-38179 is a medium-severity vulnerability in SAP Business One, published on 12 Oct 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Debug function of Admin UI of SAP Business One Integration is enabled by default. This allows Admin User to see the captured packet contents which may include User credentials.
Which versions are affected by CVE-2021-38179?
It affects 1 product.
Products include Sap Business One.
How do I fix CVE-2021-38179?
No fix has been published for CVE-2021-38179 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-38179 being exploited?
There is no known exploitation of CVE-2021-38179 in the wild and no public exploit code.
Other vulnerabilities in SAP Business One
Sources
Also known as GHSA-mm38-6jpm-jfc4.