SAP SE SAP Business One, version for SAP HANA (Cookbooks)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.27 % · percentile 19 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- sap
- NVD status
- Modified
Description
Under certain conditions, SAP Business One Hana Chef Cookbook, versions - 8.82, 9.0, 9.1, 9.2, 9.3, 10.0, used to install SAP Business One for SAP HANA, allows an attacker to exploit an insecure temporary backup path and to access information which would otherwise be restricted, resulting in Information Disclosure vulnerability highly impacting the confidentiality, integrity and availability of the application.
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | HIGH 7.8 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | sap |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.0 | HIGH 7.8 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · cna@sap.com (Secondary) |
| CVSS 2.0 | HIGH 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2021-14363
- GCVE · GCVE-0-2021-27616
CERT-FR advisories
- CERTFR-2021-AVI-356 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:sap:business-one-hana-chef-cookbook:0.1.6:*:*:*:*:*:*:*cpe:2.3:a:sap:business-one-hana-chef-cookbook:0.1.7:*:*:*:*:*:*:*cpe:2.3:a:sap:business-one-hana-chef-cookbook:0.1.19:*:*:*:*:*:*:*cpe:2.3:a:sap:business_one:8.82:*:*:*:*:*:*:*cpe:2.3:a:sap:business_one:9.0:*:*:*:*:*:*:*cpe:2.3:a:sap:business_one:9.1:*:*:*:*:*:*:*cpe:2.3:a:sap:business_one:9.2:*:*:*:*:*:*:*cpe:2.3:a:sap:business_one:9.3:*:*:*:*:*:*:*cpe:2.3:a:sap:business_one:10.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| SAP SE · SAP Business One, version for SAP HANA (Cookbooks) | affected < 8.82 ; affected < 9.0 ; affected < 9.1 ; affected < 9.2 ; affected < 9.3 ; affected < 10.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |