PT-2021-14543 · Sap · Sap Master Data Management

Published 2021-02-09 · Updated 2021-02-16 · CVE-2021-21475

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Master Data Management versions 710 through 710.750

Description The issue allows an unauthorized attacker to exploit insufficient validation of path information provided by users. This enables characters representing 'traverse to parent directory' to be passed through to the file APIs, resulting in a Directory Traversal vulnerability. The attacker could read the content of arbitrary files on the remote server and expose sensitive data.

Recommendations For SAP Master Data Management versions 710 through 710.750, consider restricting access to the file APIs to minimize the risk of exploitation until a patch is available. As a temporary workaround, disabling the functionality that allows user-provided path information to be passed to the file APIs could help mitigate the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-21475

Affected Products

Sap Master Data Management

References · 6

• https://osv.dev/vulnerability/CVE-2021-21475 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21475 · Security Note
• https://launchpad.support.sap.com/#/notes/3000897 · Note
• https://t.me/cvenotify/9688 · Telegram Post
• https://t.me/cibsecurity/23335 · Telegram Post