CVE-2021-40504

CVE-2021-40504

Vendor Sap Se
Product SAP NetWeaver AS for ABAP and ABAP Platform
Weakness CWE-863 · Incorrect authorization
Published November 10, 2021
Last update August 4, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, contains transport authorizations, which exceed expected display only permissions.

Key dates

02Disclosure timeline

November 10, 2021 CVE published
August 4, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-2201 Broken access control vulnerability in the Innovación y Cualificación IcProgreso plugin CVE-2023-0298 Incorrect Authorization in firefly-iii/firefly-iii CVE-2026-42883 Audiobookshelf: Cross-library file exfiltration via unscoped bulk download endpoint CVE-2024-38329 IBM Storage Protect for Virtual Environments: Data Protection for VMware security bypass CVE-2025-54877 Tuleap's special and always there fields permissions are not verified in cross-tracker search