CVE-2021-38164

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-09-14 · updated 2026-06-17
Weakness: CWE-862

Description

SAP ERP Financial Accounting (RFOPENPOSTING_FR) versions - SAP_APPL - 600, 602, 603, 604, 605, 606, 616, SAP_FIN - 617, 618, 700, 720, 730, SAPSCORE - 125, S4CORE, 100, 101, 102, 103, 104, 105, allows a registered attacker to invoke certain functions that would otherwise be restricted to specific users. These functions are normally exposed over the network and once exploited the attacker may be able to view and modify financial accounting data that only a specific user should have access to.

Affected products

SAP SE SAP ERP Financial Accounting (RFOPENPOSTING_FR): 100, 101, 102, 103, 104, 105 (+14)

References

https://launchpad.support.sap.com/#/notes/3068582
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405
https://launchpad.support.sap.com/#/notes/3068582
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405

Get alerted when CVE-2021-38164 or the next vulnerability affects your stack