Missing authorization in SAP ERP HCM Portugal
Priority LOW 21CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.
Summary
SAP ERP HCM Portugal does not perform necessary authorization checks for a report that reads the payroll data of employees in a certain area. Since the affected report only reads the payroll information, the attacker can neither modify any information nor cause availability impacts.
Why it matters now
EPSS 0.00571 47th percentileScored 2026-11-07
Fix Fixed SAP ERP HCM Portugal (SAP SE): 600, 604, 608
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP ERP HCM Portugal | before 600; before 604; before 608 | 600, 604, 608 | Patch available | CNA |
- SAP ERP HCM Portugal VendorSAP Affected before 600; before 604; before 608 Fixed in 600, 604, 608 Patch available CNA
Remediation
- Fix · CNA SAP ERP HCM Portugal (SAP SE) Fixed in 600, 604, 608
Timeline
- 2026-10-02 Threatist record created from CVE-2021-42062
- 2026-10-03 Alias added: GHSA-8qwq-m68r-6pcj
References
More SAP Erp Human Capital Management vulnerabilities
- TI-2022-06810 Missing authorization in SAP ERP HCM CVSS 3.1MEDIUM 6.5
Sources
- CVE-2021-42062 · CVE Program
- CVE-2021-42062 · NVD
- FIRST EPSS
- GHSA-8qwq-m68r-6pcj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences