CVE-2021-33676

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A missing authority check in SAP CRM, versions - 700, 701, 702, 712, 713, 714, could be leveraged by an attacker with high privileges to compromise confidentiality, integrity, or availability of the system.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Jul 14, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-336777.5SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 702, 730, 731, 804, 740, 750, 784, expose functions to external which can lead CVE-2021-336786.5A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75ACVE-2021-336795.4The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to inject a malicious script CVE-2021-336806.5SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which causes bufferCVE-2021-336816.5SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which causes out ofCVE-2021-336825.4SAP Lumira Server version 2.4 does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. ThCVE-2021-336834.3SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22CVE-2021-336845.3SAP NetWeaver AS ABAP and ABAP Platform, versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUCCVE-2021-336856.5SAP Business One version - 10.0 allows low-level authorized attacker to traverse the file system to access files or directories that are outCVE-2021-336865.3Under certain conditions, SAP Business One version - 10.0, allows an unauthorized attacker to get access to some encrypted sensitive informaCVE-2021-336874.9SAP NetWeaver AS JAVA (Enterprise Portal), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 reveals sensitive information in one of their HTTP CVE-2021-336884.3SAP Business One allows an attacker with business privileges to execute crafted database queries, exposing the back-end database. Due to fra
CVE-2021-33676: High severity, CVSS 7.2 | Vulnix