Missing authorization in SAP ERP Financial Accounting
Priority LOW 25CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.
Summary
SAP ERP Financial Accounting (RFOPENPOSTING_FR) versions - SAP_APPL - 600, 602, 603, 604, 605, 606, 616, SAP_FIN - 617, 618, 700, 720, 730, SAPSCORE - 125, S4CORE, 100, 101, 102, 103, 104, 105, allows a registered attacker to invoke certain functions that would otherwise be restricted to specific users. These functions are normally exposed over the network and once exploited the attacker may be able to view and modify financial accounting data that only a specific user should have access to.
Why it matters now
EPSS 0.00482 41st percentileScored 2026-11-07
Fix Fixed SAP ERP Financial Accounting (RFOPENPOSTING_FR) (SAP SE): 602, 603, 604 +13
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP ERP Financial Accounting (RFOPENPOSTING_FR) | < SAP_APPL - 600; before 602; before 603; before 604; before 605; before 606; before 616; < SAP_FIN - 617; before 618; before 700; before 720; before 730; < SAPSCORE - 125; < S4CORE; before 100; before 101; before 102; before 103; before 104; before 105 | 602, 603, 604, 605, 606, 616, 618, 700, 720, 730, 100, 101, 102, 103, 104, 105 | Patch available | CNA |
- SAP ERP Financial Accounting (RFOPENPOSTING_FR) VendorSAP Affected < SAP_APPL - 600; before 602; before 603; before 604; before 605; before 606; before 616; < SAP_FIN - 617; before 618; before 700; before 720; before 730; < SAPSCORE - 125; < S4CORE; before 100; before 101; before 102; before 103; before 104; before 105 Fixed in 602, 603, 604, 605, 606, 616, 618, 700, 720, 730, 100, 101, 102, 103, 104, 105 Patch available CNA
CPE configurations NVD · 20
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:erp_financial_accounting:100:*:*:*:*:*:*:* | 100 | Vulnerable | SAP |
| cpe:2.3:a:sap:erp_financial_accounting:101:*:*:*:*:*:*:* | 101 | Vulnerable | SAP |
| cpe:2.3:a:sap:erp_financial_accounting:102:*:*:*:*:*:*:* | 102 | Vulnerable | SAP |
| cpe:2.3:a:sap:erp_financial_accounting:103:*:*:*:*:*:*:* | 103 | Vulnerable | SAP |
| cpe:2.3:a:sap:erp_financial_accounting:104:*:*:*:*:*:*:* | 104 | Vulnerable | SAP |
| cpe:2.3:a:sap:erp_financial_accounting:105:*:*:*:*:*:*:* | 105 | Vulnerable | SAP |
| cpe:2.3:a:sap:erp_financial_accounting:602:*:*:*:*:*:*:* | 602 | Vulnerable | SAP |
| cpe:2.3:a:sap:erp_financial_accounting:603:*:*:*:*:*:*:* | 603 | Vulnerable | SAP |
| cpe:2.3:a:sap:erp_financial_accounting:604:*:*:*:*:*:*:* | 604 | Vulnerable | SAP |
| cpe:2.3:a:sap:erp_financial_accounting:605:*:*:*:*:*:*:* | 605 | Vulnerable | SAP |
- cpe:2.3:a:sap:erp_financial_accounting:100:*:*:*:*:*:*:* Versions 100 Vulnerable ·SAP
- cpe:2.3:a:sap:erp_financial_accounting:101:*:*:*:*:*:*:* Versions 101 Vulnerable ·SAP
- cpe:2.3:a:sap:erp_financial_accounting:102:*:*:*:*:*:*:* Versions 102 Vulnerable ·SAP
- cpe:2.3:a:sap:erp_financial_accounting:103:*:*:*:*:*:*:* Versions 103 Vulnerable ·SAP
- cpe:2.3:a:sap:erp_financial_accounting:104:*:*:*:*:*:*:* Versions 104 Vulnerable ·SAP
- cpe:2.3:a:sap:erp_financial_accounting:105:*:*:*:*:*:*:* Versions 105 Vulnerable ·SAP
- cpe:2.3:a:sap:erp_financial_accounting:602:*:*:*:*:*:*:* Versions 602 Vulnerable ·SAP
- cpe:2.3:a:sap:erp_financial_accounting:603:*:*:*:*:*:*:* Versions 603 Vulnerable ·SAP
- cpe:2.3:a:sap:erp_financial_accounting:604:*:*:*:*:*:*:* Versions 604 Vulnerable ·SAP
- cpe:2.3:a:sap:erp_financial_accounting:605:*:*:*:*:*:*:* Versions 605 Vulnerable ·SAP
Show 10 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:erp_financial_accounting:606:*:*:*:*:*:*:* | 606 | Vulnerable | SAP |
| cpe:2.3:a:sap:erp_financial_accounting:616:*:*:*:*:*:*:* | 616 | Vulnerable | SAP |
| cpe:2.3:a:sap:erp_financial_accounting:618:*:*:*:*:*:*:* | 618 | Vulnerable | SAP |
| cpe:2.3:a:sap:erp_financial_accounting:700:*:*:*:*:*:*:* | 700 | Vulnerable | SAP |
| cpe:2.3:a:sap:erp_financial_accounting:720:*:*:*:*:*:*:* | 720 | Vulnerable | SAP |
| cpe:2.3:a:sap:erp_financial_accounting:730:*:*:*:*:*:*:* | 730 | Vulnerable | SAP |
| cpe:2.3:a:sap:erp_financial_accounting:s4core:*:*:*:*:*:*:* | s4core | Vulnerable | SAP |
| cpe:2.3:a:sap:erp_financial_accounting:sap_appl_-_600:*:*:*:*:*:*:* | sap_appl_-_600 | Vulnerable | SAP |
| cpe:2.3:a:sap:erp_financial_accounting:sap_fin_-_617:*:*:*:*:*:*:* | sap_fin_-_617 | Vulnerable | SAP |
| cpe:2.3:a:sap:erp_financial_accounting:sapscore_-_125:*:*:*:*:*:*:* | sapscore_-_125 | Vulnerable | SAP |
- cpe:2.3:a:sap:erp_financial_accounting:606:*:*:*:*:*:*:* Versions 606 Vulnerable ·SAP
- cpe:2.3:a:sap:erp_financial_accounting:616:*:*:*:*:*:*:* Versions 616 Vulnerable ·SAP
- cpe:2.3:a:sap:erp_financial_accounting:618:*:*:*:*:*:*:* Versions 618 Vulnerable ·SAP
- cpe:2.3:a:sap:erp_financial_accounting:700:*:*:*:*:*:*:* Versions 700 Vulnerable ·SAP
- cpe:2.3:a:sap:erp_financial_accounting:720:*:*:*:*:*:*:* Versions 720 Vulnerable ·SAP
- cpe:2.3:a:sap:erp_financial_accounting:730:*:*:*:*:*:*:* Versions 730 Vulnerable ·SAP
- cpe:2.3:a:sap:erp_financial_accounting:s4core:*:*:*:*:*:*:* Versions s4core Vulnerable ·SAP
- cpe:2.3:a:sap:erp_financial_accounting:sap_appl_-_600:*:*:*:*:*:*:* Versions sap_appl_-_600 Vulnerable ·SAP
- cpe:2.3:a:sap:erp_financial_accounting:sap_fin_-_617:*:*:*:*:*:*:* Versions sap_fin_-_617 Vulnerable ·SAP
- cpe:2.3:a:sap:erp_financial_accounting:sapscore_-_125:*:*:*:*:*:*:* Versions sapscore_-_125 Vulnerable ·SAP
Remediation
- Fix · CNA SAP ERP Financial Accounting (RFOPENPOSTING_FR) (SAP SE) Fixed in 602, 603, 604, 605, 606, 616, 618, 700, 720, 730, 100, 101, 102, 103, 104, 105
Timeline
- 2026-10-02 Threatist record created from CVE-2021-38164
- 2026-10-03 Alias added: GHSA-hfg4-62f6-fjff
References
More SAP Erp Financial Accounting vulnerabilities
- TI-2022-13513 Incorrect authorization in SAP ERP, localization for CEE countries. CVSS 3.1MEDIUM 6.5
Sources
- CVE-2021-38164 · CVE Program
- CVE-2021-38164 · NVD
- FIRST EPSS
- GHSA-hfg4-62f6-fjff · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences