Security readout for executives and security teams
Plain-English summary
This vulnerability concerns SAP Business One installations that may leave sensitive information exposed on the local file system. Abuse requires local access and high privileges, but the impact could be serious because restricted information may become accessible.
Executive priority
Treat this as a targeted operational risk, not an internet-wide emergency. Prioritize validation on production SAP Business One servers, especially where multiple administrators, service accounts, or third-party support users have local access.
Technical view
CVE-2021-33662 is a medium-severity SAP Business One issue with CVSS 6.7. The vector is local, low complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality, integrity, and availability impact.
Likely exposure
Likely exposure is limited to organizations running affected SAP Business One installations. The source bundle has inconsistent version wording: the title references version 10.0, while the affected list says versions below 10.0. Confirm applicability against SAP Note 3058382.
Exploitation context
The provided sources do not show active exploitation, and this CVE is not marked as CISA KEV. The attack path appears local and privileged, reducing broad internet-scale risk but still mattering on shared, managed, or compromised hosts.
Researcher notes
Evidence is sparse in the public bundle. The CVSS vector indicates local privileged access is required, while impact ratings are high. Avoid assuming exploit availability or a specific patch mechanism beyond SAP Note 3058382.
Mitigation direction
- Review SAP Note 3058382 for official applicability and remediation guidance.
- Apply SAP-provided updates or configuration changes if the note identifies them.
- Restrict operating-system access to SAP Business One installation paths.
- Review file permissions around SAP Business One sensitive installation artifacts.
- Monitor privileged local access to affected SAP Business One hosts.
Validation and detection
- Inventory SAP Business One installations and record exact versions.
- Check whether each system matches SAP Note 3058382 applicability.
- Review local filesystem permissions on SAP Business One installation directories.
- Confirm sensitive files are not readable by unintended local accounts.
- Document compensating controls where immediate SAP remediation is unavailable.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-33662 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.7 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H0.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
6.7MediumVector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999CVE reference · x_refsource_MISC
- https://launchpad.support.sap.com/#/notes/3058382CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.