Vulnerability · Published Apr 13, 2021 · Assigned by sap

CVE-2021-21482

High 8.3

In plain English

A high-severity security flaw in SAP NetWeaver Master Data Management from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.0)8.3High

Exploit odds (30 days)0.4%top 61.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

SAP NetWeaver Master Data Management, versions - 710, 710.750, allows a malicious unauthorized user with access to the MDM Server subnet to find the password using a brute force method. If successful, the attacker could obtain access to highly sensitive data and MDM administrative privileges leading to information disclosure vulnerability thereby affecting the confidentiality and integrity of the application. This happens when security guidelines and recommendations concerning administrative accounts of an SAP NetWeaver Master Data Management installation have not been thoroughly reviewed.

Affected products (as reported)

Vendor	Product	Versions
SAP SE	SAP NetWeaver Master Data Management	< 710< 710.750

References

https://launchpad.support.sap.com/#/notes/3017908 x_refsource_MISC
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649 x_refsource_MISC