Security readout for executives and security teams
Plain-English summary
This flaw lets a logged-in SAP user access financial accounting functions intended for specific authorized users. If exploited, they could view or change financial accounting data. It is not described as unauthenticated or actively exploited, but it affects sensitive business records.
Executive priority
Treat this as a targeted remediation item for SAP finance environments. The rating is moderate, but the affected data is financially sensitive, so prioritize version verification, SAP note review, and role tightening on systems supporting accounting operations.
Technical view
CVE-2021-38164 is a missing authorization issue in SAP ERP Financial Accounting RFOPENPOSTING_FR across listed SAP_APPL, SAP_FIN, SAPSCORE, and S4CORE versions. CVSS 5.4: network-accessible, low complexity, low privileges required, no user interaction, with low confidentiality and integrity impact and no availability impact.
Likely exposure
Exposure is most relevant to organizations running affected SAP ERP or S/4HANA financial accounting components where registered users can reach RFOPENPOSTING_FR functions over the network. Risk depends on deployed component versions, role design, and whether accounts with limited privileges can access the affected functionality.
Exploitation context
The source bundle does not show CISA KEV listing or public active exploitation. Exploitation requires a registered attacker account and network access. The business risk is unauthorized viewing or modification of financial accounting data normally restricted to specific users.
Researcher notes
The record maps to CWE-862 and describes improper authorization around normally restricted functions. Available evidence does not include exploit details, patch mechanics, or observed exploitation. Validation should focus on component versioning, SAP note applicability, and authorization boundaries rather than exploit reproduction.
Mitigation direction
- Review SAP Security Note 3068582 for official corrections and prerequisites.
- Apply SAP-supported updates or configuration changes specified by the vendor.
- Restrict SAP account access to users with a clear business need.
- Review financial accounting roles for excessive authorization during remediation.
- Monitor sensitive accounting data changes for unexpected user activity.
Validation and detection
- Inventory SAP systems for affected SAP_APPL, SAP_FIN, SAPSCORE, and S4CORE versions.
- Confirm whether RFOPENPOSTING_FR exists on in-scope SAP systems.
- Verify SAP Security Note 3068582 status in SAP Launchpad.
- Review authorization assignments for users with access to affected accounting functions.
- Check logs for unusual financial accounting data access or modification.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-38164 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.4 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N2.82.5Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
5.4MediumVector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405CVE reference · x_refsource_MISC
- https://launchpad.support.sap.com/#/notes/3068582CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.