CVE-2021-21473

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

SAP NetWeaver AS ABAP and ABAP Platform, versions - 700, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, contains function module SRM_RFC_SUBMIT_REPORT which fails to validate authorization of an authenticated user thus allowing an unauthorized user to execute reports in SAP NetWeaver ABAP Platform.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Jun 9, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-214746.5SAP HANA Database, versions - 1.0, 2.0, accepts SAML tokens with MD5 digest, an attacker who manages to obtain an MD5-digest signed SAML AssCVE-2021-214757.5Under specific circumstances SAP Master Data Management, versions - 710, 710.750, allows an unauthorized attacker to exploit insufficient vaCVE-2021-214766.1SAP UI5 versions before 1.38.49, 1.52.49, 1.60.34, 1.71.31, 1.78.18, 1.84.5, 1.85.4, 1.86.1 allows an unauthenticated attacker to redirect uCVE-2021-214779.9SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticatCVE-2021-214786.1SAP Web Dynpro ABAP allow an attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities.CVE-2021-214799.1In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availability and integrity oCVE-2021-214808.8SAP MII allows users to create dashboards and save them as JSP through the SSCE (Self Service Composition Environment). An attacker can inteCVE-2021-214818.8The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization chCVE-2021-214828.3SAP NetWeaver Master Data Management, versions - 710, 710.750, allows a malicious unauthorized user with access to the MDM Server subnet to CVE-2021-214834.9Under certain conditions SAP Solution Manager, version - 720, allows a high privileged attacker to get access to sensitive information whichCVE-2021-214849.8LDAP authentication in SAP HANA Database version 2.0 can be bypassed if the attached LDAP directory server is configured to enable unauthentCVE-2021-214856.5An unauthorized attacker may be able to entice an administrator to invoke telnet commands of an SAP NetWeaver Application Server for Java th
CVE-2021-21473: Medium severity, CVSS 6.3 | Vulnix