TI-2021-09061 Aliases CVE-2021-27609 GHSA-89c5-cmj9-mcpm

Missing authorization in SAP Focused RUN

LOW 30CWE-862Published 2021-04-13 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

SAP Focused RUN versions 200, 300, does not perform necessary authorization checks for an authenticated user, which allows a user to call the oData service and manipulate the activation for the SAP EarlyWatch Alert service data collection and sending to SAP without the intended authorization.

Why it matters now

EPSS 0.00533 45th percentileScored 2026-11-07

Fix Fixed SAP Focused RUN (SAP SE): 200, 300

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP Focused RUN	before 200; before 300	200, 300	Patch available	CNA

SAP Focused RUN VendorSAP Affected before 200; before 300 Fixed in 200, 300 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:focused_run:200:::::::*	200	Vulnerable	SAP
cpe:2.3:a:sap:focused_run:300:::::::*	300	Vulnerable	SAP

cpe:2.3:a:sap:focused_run:200:*:*:*:*:*:*:* Versions 200 Vulnerable ·SAP
cpe:2.3:a:sap:focused_run:300:*:*:*:*:*:*:* Versions 300 Vulnerable ·SAP

Remediation

Fix · CNA SAP Focused RUN (SAP SE) Fixed in 200, 300

Timeline

2026-10-02 Threatist record created from CVE-2021-27609
2026-10-03 Alias added: GHSA-89c5-cmj9-mcpm

References

Advisory 1

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649

Other 1

https://launchpad.support.sap.com/#/notes/3030948

TI-2020-05220 SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7… CVSS 3.1MEDIUM 5.9
TI-2022-08275 Cross-site scripting in SAP Focused Run CVSS 3.1MEDIUM 6.1
TI-2022-10638 Path traversal in SAP Focused Run CVSS 3.1LOW 2.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences