CVE-2021-33704

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-09-15 · updated 2026-06-17
Weakness: CWE-862

Description

The Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions that would otherwise be restricted to specific users. For an attacker to discover the vulnerable function, no in-depth system knowledge is required. Once exploited via Network stack, the attacker may be able to read, modify or delete restricted data. The impact is that missing authorization can result of abuse of functionality usually restricted to specific users.

Affected products

SAP SE SAP Business One: 10.0

References

https://launchpad.support.sap.com/#/notes/3078072
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806
https://launchpad.support.sap.com/#/notes/3078072
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806

Get alerted when CVE-2021-33704 or the next vulnerability affects your stack