CVE-2021-41251: Possibility to elevate privileges or get unauthorized access to data
First published: Fri Nov 05 2021(Updated: )
@sap-cloud-sdk/core contains the core functionality of the SAP Cloud SDK as well as the SAP Business Technology Platform abstractions. This affects applications on SAP Business Technology Platform that use the SAP Cloud SDK and enabled caching of destinations. In affected versions and in some cases, when user information was missing, destinations were cached without user information, allowing other users to retrieve the same destination with its permissions. By default, destination caching is disabled. The security for caching has been increased. The changes are released in version 1.52.0. Users unable to upgrade are advised to disable destination caching (it is disabled by default).
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP Cloud SDK | <1.52.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-41251?
CVE-2021-41251 is considered a medium severity vulnerability affecting caching of destinations in the SAP Cloud SDK.
How do I fix CVE-2021-41251?
To mitigate CVE-2021-41251, upgrade to SAP Cloud SDK version 1.52.0 or later.
What software is affected by CVE-2021-41251?
CVE-2021-41251 impacts applications on the SAP Business Technology Platform using versions of SAP Cloud SDK up to 1.52.0.
What type of vulnerability is CVE-2021-41251?
CVE-2021-41251 is a vulnerability related to the caching mechanism in the SAP Cloud SDK.
Who should be concerned about CVE-2021-41251?
Developers and organizations using SAP Cloud SDK for applications within the SAP Business Technology Platform should be concerned about CVE-2021-41251.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/remedy
- agent/severity
- agent/references
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/type
- agent/last-modified-date
- agent/author
- agent/softwarecombine
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/sap
- canonical/sap cloud sdk