Read the docs
TI-2021-19922 Aliases CVE-2021-44232GHSA-4g5h-vp8c-mrhf

Path traversal in SAP SAF-T Framework

Priority LOW 36CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

SAF-T Framework Transaction SAFTN_G allows an attacker to exploit insufficient validation of path information provided by normal user, leading to full server directory access. The attacker can see the whole filesystem structure but cannot overwrite, delete, or corrupt arbitrary files on the server.

Why it matters now

EPSS 0.01007 63rd percentileScored 2026-11-07
Fix Fixed SAF-T Framework (SAP SE): 618, 720, 730 +8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAF-T Framework< SAP_FIN 617; before 618; before 720; before 730; < SAP_APPL 600; before 602; before 603; before 604; before 605; before 606; < S4CORE 102; before 103; before 104; before 105618, 720, 730, 602, 603, 604, 605, 606, 103, 104, 105Patch availableCNA
  • SAF-T Framework VendorSAP Affected < SAP_FIN 617; before 618; before 720; before 730; < SAP_APPL 600; before 602; before 603; before 604; before 605; before 606; < S4CORE 102; before 103; before 104; before 105 Fixed in 618, 720, 730, 602, 603, 604, 605, 606, 103, 104, 105 Patch available CNA

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:sap:saf-t_framework:103:*:*:*:*:*:*:*103VulnerableSAP
cpe:2.3:a:sap:saf-t_framework:104:*:*:*:*:*:*:*104VulnerableSAP
cpe:2.3:a:sap:saf-t_framework:105:*:*:*:*:*:*:*105VulnerableSAP
cpe:2.3:a:sap:saf-t_framework:602:*:*:*:*:*:*:*602VulnerableSAP
cpe:2.3:a:sap:saf-t_framework:603:*:*:*:*:*:*:*603VulnerableSAP
cpe:2.3:a:sap:saf-t_framework:604:*:*:*:*:*:*:*604VulnerableSAP
cpe:2.3:a:sap:saf-t_framework:605:*:*:*:*:*:*:*605VulnerableSAP
cpe:2.3:a:sap:saf-t_framework:606:*:*:*:*:*:*:*606VulnerableSAP
cpe:2.3:a:sap:saf-t_framework:618:*:*:*:*:*:*:*618VulnerableSAP
cpe:2.3:a:sap:saf-t_framework:720:*:*:*:*:*:*:*720VulnerableSAP
  • cpe:2.3:a:sap:saf-t_framework:103:*:*:*:*:*:*:* Versions 103 Vulnerable ·SAP
  • cpe:2.3:a:sap:saf-t_framework:104:*:*:*:*:*:*:* Versions 104 Vulnerable ·SAP
  • cpe:2.3:a:sap:saf-t_framework:105:*:*:*:*:*:*:* Versions 105 Vulnerable ·SAP
  • cpe:2.3:a:sap:saf-t_framework:602:*:*:*:*:*:*:* Versions 602 Vulnerable ·SAP
  • cpe:2.3:a:sap:saf-t_framework:603:*:*:*:*:*:*:* Versions 603 Vulnerable ·SAP
  • cpe:2.3:a:sap:saf-t_framework:604:*:*:*:*:*:*:* Versions 604 Vulnerable ·SAP
  • cpe:2.3:a:sap:saf-t_framework:605:*:*:*:*:*:*:* Versions 605 Vulnerable ·SAP
  • cpe:2.3:a:sap:saf-t_framework:606:*:*:*:*:*:*:* Versions 606 Vulnerable ·SAP
  • cpe:2.3:a:sap:saf-t_framework:618:*:*:*:*:*:*:* Versions 618 Vulnerable ·SAP
  • cpe:2.3:a:sap:saf-t_framework:720:*:*:*:*:*:*:* Versions 720 Vulnerable ·SAP
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sap:saf-t_framework:730:*:*:*:*:*:*:*730VulnerableSAP
cpe:2.3:a:sap:saf-t_framework:s4core_102:*:*:*:*:*:*:*s4core_102VulnerableSAP
cpe:2.3:a:sap:saf-t_framework:sap_appl_600:*:*:*:*:*:*:*sap_appl_600VulnerableSAP
cpe:2.3:a:sap:saf-t_framework:sap_fin_617:*:*:*:*:*:*:*sap_fin_617VulnerableSAP
  • cpe:2.3:a:sap:saf-t_framework:730:*:*:*:*:*:*:* Versions 730 Vulnerable ·SAP
  • cpe:2.3:a:sap:saf-t_framework:s4core_102:*:*:*:*:*:*:* Versions s4core_102 Vulnerable ·SAP
  • cpe:2.3:a:sap:saf-t_framework:sap_appl_600:*:*:*:*:*:*:* Versions sap_appl_600 Vulnerable ·SAP
  • cpe:2.3:a:sap:saf-t_framework:sap_fin_617:*:*:*:*:*:*:* Versions sap_fin_617 Vulnerable ·SAP

Remediation

  • Fix · CNA SAF-T Framework (SAP SE) Fixed in 618, 720, 730, 602, 603, 604, 605, 606, 103, 104, 105

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-44232
  2. 2026-10-03 Alias added: GHSA-4g5h-vp8c-mrhf

References

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences