CVE-2021-33686
Quick assessment
Affected
SAP SE SAP Business One
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SAP Business One是德国思爱普（SAP）公司的一套企业管理软件。该软件包括财务管理、运营管理和人力资源管理等功能。 SAP Business One存在信息泄露漏洞，该漏洞允许未经授权的攻击者可利用该漏洞访问一些加密的敏感信息，但不能控制种类或程度。
Possible ATT&CK Techniques 1 AI
T1552.004 · Private Keys
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-33686
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Under certain conditions, SAP Business One version - 10.0, allows an unauthorized attacker to get access to some encrypted sensitive information, but does not have control over kind or degree.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
SAP Business One 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP Business One是德国思爱普（SAP）公司的一套企业管理软件。该软件包括财务管理、运营管理和人力资源管理等功能。 SAP Business One存在信息泄露漏洞，该漏洞允许未经授权的攻击者可利用该漏洞访问一些加密的敏感信息，但不能控制种类或程度。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP SE | SAP Business One | < 10.0 | - |
|
II. Public POCs for CVE-2021-33686
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-33686
请登录查看更多情报信息。
Other References for CVE-2021-33686 (2)
-
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 x_refsource_MISC
-
https://launchpad.support.sap.com/#/notes/3070138 x_refsource_MISC
Same Patch Batch · SAP SE · 2021-09-14 · 20 CVEs total
| CVE-2021-38163 | 9.9 CRITICAL | SAP NetWeaver 路径遍历漏洞 |
| CVE-2021-38162 | 8.9 HIGH | SAP Web dispatcher 环境问题漏洞 |
| CVE-2021-33675 | SAP Contact Center 跨站脚本漏洞 | |
| CVE-2021-38150 | SAP Business Client 安全漏洞 | |
| CVE-2021-37531 | SAP NetWeaver Knowledge Management Configuration Service 操作系统命令注入漏洞 | |
| CVE-2021-21489 | SAP Enterprise Portal 跨站脚本漏洞 | |
| CVE-2021-37532 | SAP Business One 路径遍历漏洞 | |
| CVE-2021-33673 | SAP Contact Center 跨站脚本漏洞 | |
| CVE-2021-38164 | SAP ERP 安全漏洞 | |
| CVE-2021-38176 | SAP NZDT SQL注入漏洞 | |
| CVE-2021-33679 | SAP BusinessObjects BI Platform 420 跨站脚本漏洞 | |
| CVE-2021-38174 | SAP 3D Visual Enterprise Viewer 输入验证错误漏洞 | |
| CVE-2021-37535 | SAP NetWeaver Application Server Java 授权问题漏洞 | |
| CVE-2021-38175 | Microsoft Office 信息泄露漏洞 | |
| CVE-2021-33672 | SAP Contact Center 安全漏洞 | |
| CVE-2021-33685 | SAP Business One 路径遍历漏洞 | |
| CVE-2021-38177 | SAP CommonCryptoLib代码问题漏洞 | |
| CVE-2021-33674 | SAP Contact Center 跨站脚本漏洞 | |
| CVE-2021-33688 | SAP Business One SQL注入漏洞 |
IV. Related Vulnerabilities
Same product: SAP Business One
Same vendor: SAP SE
-
CVE-2025-42956
Multiple vulnerabilities in SAP NetWeaver Application Server -
CVE-2023-36920
Clickjacking vulnerability in SAP Enable Now -
CVE-2023-40307
Privileges Memory Corruption (Out-of-bound write) -
CVE-2023-40306
URL Redirection vulnerability in SAP S/4HANA (Manage Catalog -
CVE-2022-41211
SAP 3D Visual Enterprise Viewer和SAP 3D Visual Enterprise Aut
V. Comments for CVE-2021-33686
No comments yet