PT-2021-14547 · Sap · Sap Netweaver

Published 2021-03-09 · Updated 2021-06-12 · CVE-2021-21481

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP NetWeaver versions 7.10 through 7.50

Description The MigrationService, which is part of SAP NetWeaver, does not perform an authorization check. This might allow an unauthorized attacker to access configuration objects, including those that grant administrative privileges. This could result in complete compromise of system confidentiality, integrity, and availability.

Recommendations For SAP NetWeaver versions 7.10 through 7.50, consider disabling the MigrationService until a patch is available to prevent unauthorized access to configuration objects. Restrict access to configuration objects that grant administrative privileges to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2021-21481

Affected Products

Sap Netweaver

References · 6

• https://osv.dev/vulnerability/CVE-2021-21481 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21481 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3022422 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/3597 · Telegram Post
• https://t.me/cibsecurity/24606 · Telegram Post