CVE-2021-40496 - CVE House

Back to Database

Status published Medium CVE-2021-40496

SAP Internet Communication framework (ICM) - versions 700, 701, 702,...

4.3 CVSS

Vulnerability Description

SAP Internet Communication framework (ICM) - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785, allows an attacker with logon functionality, to exploit the authentication function by using POST and form field to repeat executions of the initial command by a GET request and exposing sensitive data. This vulnerability is normally exposed over the network and successful exploitation can lead to exposure of data like system details.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-40496

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from SAP SE

View All →

Multiple vulnerabilities in SAP NetWeaver Application Server ABAP

Privileges Memory Corruption (Out-of-bound write)

URL Redirection vulnerability in SAP S/4HANA (Manage Catalog Items and Cross-Catalog search)

Clickjacking vulnerability in SAP Enable Now

SAP Financial Consolidation - version 1010, does not sufficiently encode...

Affected Vendor

SAP SE

View all reports →

Affected Software

SAP NetWeaver AS ABAP and ABAP Platform

Vulnerable Versions:

< 700, < 701, < 702, < 730, < 731, < 740, < 750, < 751, < 752, < 753, < 754, < 755, < 756, < 785

Timeline

Official Publish: October 12th, 2021

Last Modified: August 4th, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1213 Data from Information Repositories

T1005 Data from Local System

T1078 Valid Accounts