Vulnerability in SAP Netweaver Master Data Management
CVE-2021-21482
SAP NetWeaver Master Data Management, versions - 710, 710.750, allows a malicious unauthorized user with access to the MDM Server subnet to find the password using a brute force method. If successful, the attacker could obtain access to highly sensitive data and MDM administrative privileges leading to information disclosure vulnerability thereby affecting the confidentiality and integrity of the application. This happens when security guidelines and recommendations concerning administrative accounts of an SAP NetWeaver Master Data Management installation have not been thoroughly reviewed.
EPSS: 0.004 (34.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L.
Affected products
- Sap Netweaver_master_data_management — versions 7.10.750, 710
- Sap Se Netweaver Master Data Management — versions < 710, < 710.750
Public proof-of-concept exploits
References
- cna@sap.com (Permissions Required, x_refsource_MISC)
- cna@sap.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-21482?
- CVE-2021-21482 is a high-severity vulnerability in SAP Netweaver Master Data Management. CVSS score: 8.3/10. Published 2021-04-13.
- How severe is CVE-2021-21482?
- High severity. CVSS v3 base score is 8.3 out of 10.
- Is CVE-2021-21482 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.