Vulnerability in SAP Netweaver Application Server Java
CVE-2021-21485
An unauthorized attacker may be able to entice an administrator to invoke telnet commands of an SAP NetWeaver Application Server for Java that allow the attacker to gain NTLM hashes of a privileged user.
EPSS: 0.009 (57.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.
Affected products
- Sap Netweaver_application_server_java — versions 7.10, 7.20, 7.30
- Sap Se Netweaver As For Java (Telnet Commands) — versions ENGINEAPI 7.30, 7.31, 7.40, 7.50, ESP_FRAMEWORK 7.10, 7.20, 7.30, 7.31, 7.40, 7.50, SERVERCORE 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50
References
- cna@sap.com (x_refsource_MISC, Vendor Advisory)
- cna@sap.com (Permissions Required, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-21485?
- CVE-2021-21485 is a medium-severity vulnerability in SAP Netweaver Application Server Java. CVSS score: 6.5/10. Published 2021-04-13.
- How severe is CVE-2021-21485?
- Medium severity. CVSS v3 base score is 6.5 out of 10.