CVE-2021-38164

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

SAP ERP Financial Accounting (RFOPENPOSTING_FR) versions - SAP_APPL - 600, 602, 603, 604, 605, 606, 616, SAP_FIN - 617, 618, 700, 720, 730, SAPSCORE - 125, S4CORE, 100, 101, 102, 103, 104, 105, allows a registered attacker to invoke certain functions that would otherwise be restricted to specific users. These functions are normally exposed over the network and once exploited the attacker may be able to view and modify financial accounting data that only a specific user should have access to.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
SAP SE	SAP ERP Financial Accounting (RFOPENPOSTING_FR)	< SAP_APPL - 600; < 602; < 603; < 604; < 605; < 606; < 616; < SAP_FIN - 617; < 618; < 700; < 720; < 730; < SAPSCORE - 125; < S4CORE; < 100; < 101; < 102; < 103; < 104; < 105

References

https://launchpad.support.sap.com/#/notes/3068582Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405Vendor Advisory
https://launchpad.support.sap.com/#/notes/3068582Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405Vendor Advisory

Timeline

Published: Sep 14, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-381655.3Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because th CVE-2021-381667.8In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8, there is an integer overflow and out-of-bounds write when many elements are plac CVE-2021-381679.8Roxy-WI through 5.2.2.0 allows SQL Injection via check_login. An unauthenticated attacker can extract a valid uuid to bypass authentication.CVE-2021-381688.8Roxy-WI through 5.2.2.0 allows authenticated SQL injection via select_servers.CVE-2021-381698.8Roxy-WI through 5.2.2.0 allows command injection via /app/funct.py and /api/api_funct.py.CVE-2021-38179.8wbce_cms is vulnerable to Improper Neutralization of Special Elements used in an SQL Command CVE-2021-381719.8adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the init_get_bits return value, which is a necessary step becaus CVE-2021-381729.8perM 0.4.0 has a Buffer Overflow related to strncpy. (Debian initially fixed this in 0.4.0-7.)CVE-2021-381739.8Btrbk before 0.31.2 allows command execution because of the mishandling of remote hosts filtering SSH commands using ssh_filter_btrbk.sh in CVE-2021-381746.5When a user opens manipulated files received from untrusted sources in SAP 3D Visual Enterprise Viewer version - 9, the application crashes CVE-2021-381756.5SAP Analysis for Microsoft Office - version 2.8, allows an attacker with high privileges to read sensitive data over the network, and gather CVE-2021-381768.8Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in