CVE-2021-38179

CWE-522 — Insufficiently Protected Credentials3 documents3 sources
Severity
4.9MEDIUM
EPSS
0.3%
top 43.57%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
SAP SE SAP Business ONESAP Business ONE
Timeline
PublishedOct 12
Latest updateMay 24

Description

Debug function of Admin UI of SAP Business One Integration is enabled by default. This allows Admin User to see the captured packet contents which may include User credentials.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitability: 1.2 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5sap_se/sap_business_one< 10.0

🔴Vulnerability Details

2
GHSA
GHSA-mm38-6jpm-jfc4: Debug function of Admin UI of SAP Business One Integration is enabled by default↗2022-05-24
▶
CVEList
CVE-2021-38179: Debug function of Admin UI of SAP Business One Integration is enabled by default↗2021-10-12
▶
CVE-2021-38179 (MEDIUM CVSS 4.9) | Debug function of Admin UI of SAP B | cvebase.io