What is CVE-2021-21486?

CVE-2021-21486 is a high-severity vulnerability in Sap Enterprise Financial Services, classified under Missing Authorization. CVSS score: 8.8/10. Published 2021-03-09.

How severe is CVE-2021-21486?

High severity. CVSS v3 base score is 8.8 out of 10.

Auth bypass in Sap Enterprise Financial Services

CVE-2021-21486

SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Vulnerability class: Broken Access Control

EPSS: 0.008 (51.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Sap Enterprise_financial_services — versions 1.01, 1.02, 1.03
Sap Se Enterprise Financial Services (Bank Customer Accounts) — versions < 101, < 102, < 103

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

cna@sap.com (x_refsource_MISC, Vendor Advisory)
cna@sap.com (Permissions Required, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-21486?: CVE-2021-21486 is a high-severity vulnerability in Sap Enterprise Financial Services, classified under Missing Authorization. CVSS score: 8.8/10. Published 2021-03-09.
How severe is CVE-2021-21486?: High severity. CVSS v3 base score is 8.8 out of 10.