What is CVE-2021-21467?

CVE-2021-21467 is a medium-severity vulnerability in Sap Banking Services, classified under Missing Authorization. CVSS score: 4.3/10. Published 2021-01-12.

How severe is CVE-2021-21467?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Auth bypass in Sap Banking Services

CVE-2021-21467

SAP Banking Services (Generic Market Data) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. An unauthorized User is allowed to display restricted Business Partner Generic Market Data (GMD), due to improper authorization check.

Vulnerability class: Broken Access Control

EPSS: 0.008 (52.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Sap Banking_services
Sap Se Banking Services (Generic Market Data) — versions < 400, < 450, < 500

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

cna@sap.com (x_refsource_MISC, Vendor Advisory)
cna@sap.com (Permissions Required, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-21467?: CVE-2021-21467 is a medium-severity vulnerability in Sap Banking Services, classified under Missing Authorization. CVSS score: 4.3/10. Published 2021-01-12.
How severe is CVE-2021-21467?: Medium severity. CVSS v3 base score is 4.3 out of 10.