Vulnerability · Published Feb 9, 2021 · Assigned by sap
CVE-2021-21474
Medium 6.5
In plain English
A medium-severity security flaw in SAP HANA Database from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)0.7%top 46.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
SAP HANA Database, versions - 1.0, 2.0, accepts SAML tokens with MD5 digest, an attacker who manages to obtain an MD5-digest signed SAML Assertion issued for an SAP HANA instance might be able to tamper with it and alter it in a way that the digest continues to be the same and without invalidating the digital signature, this allows them to impersonate as user in HANA database and be able to read the contents in the database.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP HANA Database | < 1.0< 2.0 |
References
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543 x_refsource_MISC
- https://launchpad.support.sap.com/#/notes/2992154 x_refsource_MISC