What’s Vulnerable › Vulnerabilities

CVE-2021-27605

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-04-13 · updated 2026-06-17
• Weakness: CWE-862

Description

SAP's HCM Travel Management Fiori Apps V2, version - 608, does not perform proper authorization check, allowing an authenticated but unauthorized attacker to read personnel numbers of employees, resulting in escalation of privileges. However, the attacker can only read some information like last name, first name of the employees, so there is some loss of confidential information, Integrity and Availability are not impacted.

Affected products

• SAP SE SAP Fiori Apps 2.0 for Travel Management in SAP ERP: before 608 — fixed in 608

How to fix

Upgrade to a fixed version: SAP SE SAP Fiori Apps 2.0 for Travel Management in SAP ERP 608. Check the vendor advisory for mitigations.

References

• https://launchpad.support.sap.com/#/notes/3025054
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649
• https://launchpad.support.sap.com/#/notes/3025054
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649

Get alerted when CVE-2021-27605 or the next vulnerability affects your stack