PT-2021-14537 · Sap · Sap Netweaver Master Data Management

Published 2021-01-12 · Updated 2023-02-10 · CVE-2021-21469

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Master Data Management versions 7.10, 710, and 710.750

Description The issue arises when security guidelines for SAP NetWeaver Master Data Management running on Windows have not been thoroughly reviewed. This oversight might allow an external operator to set custom paths in the MDS server configuration. If adequate protection is not enforced, a malicious user could define UNC paths, exploiting them through an SMB relay attack to put the system at risk and obtain highly sensitive data, leading to Information Disclosure.

Recommendations For SAP NetWeaver Master Data Management versions 7.10, 710, and 710.750, ensure that security guidelines are thoroughly reviewed and adequate protection is enforced on all levels, including setting the MDS Server password and properly securing network and OS configurations. As a temporary workaround, consider restricting the ability to set custom paths in the MDS server configuration until a patch is available. Restrict access to sensitive data and UNC paths to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-21469

Affected Products

Sap Netweaver Master Data Management

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-21469 · Security Note
• https://launchpad.support.sap.com/#/notes/2993032 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21469 · Vendor Advisory
• https://t.me/cvenotify/44060 · Telegram Post
• https://t.me/cibsecurity/21956 · Telegram Post