CVE-2021-21471

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In CLA-Assistant, versions before 2.8.5, due to improper access control an authenticated user could access API endpoints which are not intended to be used by the user. This could impact the integrity of the application.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected software

No affected versions have been published.

Timeline

Published
Jan 12, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-214728.8SAP Software Provisioning Manager 1.0 (SAP NetWeaver Master Data Management Server 7.1) does not have an option to set password during its iCVE-2021-214736.3SAP NetWeaver AS ABAP and ABAP Platform, versions - 700, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, contains function modulCVE-2021-214746.5SAP HANA Database, versions - 1.0, 2.0, accepts SAML tokens with MD5 digest, an attacker who manages to obtain an MD5-digest signed SAML AssCVE-2021-214757.5Under specific circumstances SAP Master Data Management, versions - 710, 710.750, allows an unauthorized attacker to exploit insufficient vaCVE-2021-214766.1SAP UI5 versions before 1.38.49, 1.52.49, 1.60.34, 1.71.31, 1.78.18, 1.84.5, 1.85.4, 1.86.1 allows an unauthenticated attacker to redirect uCVE-2021-214779.9SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticatCVE-2021-214786.1SAP Web Dynpro ABAP allow an attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities.CVE-2021-214799.1In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availability and integrity oCVE-2021-214808.8SAP MII allows users to create dashboards and save them as JSP through the SSCE (Self Service Composition Environment). An attacker can inteCVE-2021-214818.8The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization chCVE-2021-214828.3SAP NetWeaver Master Data Management, versions - 710, 710.750, allows a malicious unauthorized user with access to the MDM Server subnet to CVE-2021-214834.9Under certain conditions SAP Solution Manager, version - 720, allows a high privileged attacker to get access to sensitive information which
CVE-2021-21471: Medium severity, CVSS 6.5 | Vulnix