CVE-2021-40504
First published: Wed Nov 10 2021(Updated: )
A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, contains transport authorizations, which exceed expected display only permissions.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP NetWeaver Application Server ABAP | =700 | |
| SAP NetWeaver Application Server ABAP | =701 | |
| SAP NetWeaver Application Server ABAP | =702 | |
| SAP NetWeaver Application Server ABAP | =710 | |
| SAP NetWeaver Application Server ABAP | =711 | |
| SAP NetWeaver Application Server ABAP | =730 | |
| SAP NetWeaver Application Server ABAP | =731 | |
| SAP NetWeaver Application Server ABAP | =740 | |
| SAP NetWeaver Application Server ABAP | =750 | |
| SAP NetWeaver Application Server ABAP | =751 | |
| SAP NetWeaver Application Server ABAP | =752 | |
| SAP NetWeaver Application Server ABAP | =753 | |
| SAP NetWeaver Application Server ABAP | =754 | |
| SAP NetWeaver Application Server ABAP | =755 | |
| SAP NetWeaver Application Server ABAP | =756 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-40504?
CVE-2021-40504 is a vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform that allows transport authorizations to exceed expected display only permissions.
What is the severity of CVE-2021-40504?
The severity of CVE-2021-40504 is medium with a severity value of 4.9.
What software versions are affected by CVE-2021-40504?
Versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, and 756 of SAP NetWeaver Application Server for ABAP and ABAP Platform are affected by CVE-2021-40504.
How can I fix CVE-2021-40504?
To fix CVE-2021-40504, apply the necessary patches provided by SAP and follow the recommendations mentioned in SAP Note 3105728 and the SAP community page.
What is the Common Weakness Enumeration (CWE) ID for CVE-2021-40504?
The Common Weakness Enumeration (CWE) ID for CVE-2021-40504 is 863.
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/sap
- canonical/sap netweaver application server abap
- version/sap netweaver application server abap/700
- version/sap netweaver application server abap/701
- version/sap netweaver application server abap/702
- version/sap netweaver application server abap/710
- version/sap netweaver application server abap/711
- version/sap netweaver application server abap/730
- version/sap netweaver application server abap/731
- version/sap netweaver application server abap/740
- version/sap netweaver application server abap/750
- version/sap netweaver application server abap/751
- version/sap netweaver application server abap/752
- version/sap netweaver application server abap/753
- version/sap netweaver application server abap/754
- version/sap netweaver application server abap/755
- version/sap netweaver application server abap/756