LiveActive security incident?Get immediate response
CVE Record

CVE-2021-33676: A missing authority check in SAP CRM, versions - 700, 701, 702, 712, 713, 714, could be leveraged by an att...

A missing authority check in SAP CRM, versions - 700, 701, 702, 712, 713, 714, could be leveraged by an attacker with high privileges to compromise confidentiality, integrity, or availability of the system.

MediumCVSS 6.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

SAP CRM has a missing authorization check that could let a highly privileged attacker compromise sensitive data, change system behavior, or disrupt availability. This is not described as a broad internet drive-by issue, but it matters in environments where privileged SAP access could be abused after insider activity or lateral movement.

Executive priority

Treat as a controlled but meaningful SAP risk. Prioritize review in organizations with SAP CRM, especially where privileged account controls, network segmentation, or SAP patch governance are weak.

Technical view

CVE-2021-33676 affects SAP CRM versions 700, 701, 702, 712, 713, and 714. CVSS 3.0 is 6.8 with AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating adjacent-network access, low complexity, high privileges, no user interaction, and high confidentiality, integrity, and availability impact.

Likely exposure

Exposure is likely limited to organizations running the listed SAP CRM versions where adjacent network access and high-privileged SAP accounts exist. The provided sources do not identify affected modules, deployment patterns, or fixed versions.

Exploitation context

The source bundle does not indicate CISA KEV listing or active exploitation. The required privilege level is high, so practical risk is more credible after account compromise, insider misuse, or weak privileged-access controls.

Researcher notes

Evidence is sparse in the provided bundle: no CWE, no component detail, and no public exploit evidence are cited. Validation should focus on SAP note status, version exposure, privileged access paths, and vendor-confirmed remediation.

Mitigation direction

  • Review SAP Note 3066316 and SAP Security Patch Day guidance.
  • Apply SAP vendor fixes or mitigations if provided for the deployed release.
  • Restrict privileged SAP CRM access to trusted administrators only.
  • Segment SAP CRM from untrusted adjacent networks.
  • Monitor privileged SAP activity for unusual changes or failures.

Validation and detection

  • Inventory SAP CRM versions and compare against the listed affected releases.
  • Confirm whether SAP Note 3066316 has been applied or addressed.
  • Review privileged roles with access to affected SAP CRM systems.
  • Check network paths that allow adjacent access to SAP CRM.
  • Inspect logs for unusual privileged activity around sensitive CRM functions.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-33676 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.8 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.8CVSS 3.0MediumCVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H0.95.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

6.8Medium
CVSS 3.0 vector shape for CVE-2021-33676Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
SAP SESAP CRM< 700, < 701, < 702, < 712, < 713, < 714Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.