PT-2021-14540 · Sap · Sap Software Provisioning Manager+1

Published 2021-02-09 · Updated 2023-08-08 · CVE-2021-21472

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Software Provisioning Manager version 1.0 SAP NetWeaver Master Data Management Server version 7.1

Description The issue allows an authenticated attacker to perform various security attacks due to the lack of an option to set a password during installation. This enables attacks like Directory Traversal, Password Brute force Attack, SMB Relay attack, and Security Downgrade.

Recommendations For SAP Software Provisioning Manager version 1.0, consider setting a strong password manually after installation to mitigate the risk. For SAP NetWeaver Master Data Management Server version 7.1, restrict access to sensitive areas of the server to minimize the risk of exploitation until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-21472

Affected Products

Sap Netweaver Master Data Management

Sap Software Provisioning Manager

References · 7

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21472 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21472 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2998173 · Note
• https://t.me/cvenotify/9690 · Telegram Post
• https://t.me/cibsecurity/23329 · Telegram Post
• https://t.me/cvenotify/9980 · Telegram Post