CVE-2021-27598: 
SAP NetWeaver Application Server Java vulnerability analysis and mitigation

SAP NetWeaver AS JAVA (Customer Usage Provisioning Servlet), versions 7.31, 7.40, and 7.50, contains a vulnerability due to missing authorization checks in the servlet. This vulnerability was discovered and disclosed in April 2021 (NVD, CVE).

The vulnerability is classified as a Missing Authorization (CWE-862) and Improper Access Control (CWE-284) issue. It received a CVSS v3.1 base score of 5.3 (Medium) from NVD with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, and a score of 6.5 (Medium) from SAP SE with vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (NVD).

The vulnerability allows an unauthorized attacker to access statistical data including product version information, traffic data, and timestamps due to the missing authorization check in the servlet (NVD).

The vulnerability can be exploited remotely without requiring authentication or user interaction, as indicated by the CVSS vector strings (NVD).

SAP has released security patches to address this vulnerability. Users should refer to SAP Security Note 3027937 for detailed mitigation instructions (SAP Note).