CVE-2021-21475

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Under specific circumstances SAP Master Data Management, versions - 710, 710.750, allows an unauthorized attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs. Due to this Directory Traversal vulnerability the attacker could read content of arbitrary files on the remote server and expose sensitive data.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Feb 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-214766.1SAP UI5 versions before 1.38.49, 1.52.49, 1.60.34, 1.71.31, 1.78.18, 1.84.5, 1.85.4, 1.86.1 allows an unauthenticated attacker to redirect u CVE-2021-214779.9SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticat CVE-2021-214786.1SAP Web Dynpro ABAP allow an attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities.CVE-2021-214799.1In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availability and integrity o CVE-2021-214808.8SAP MII allows users to create dashboards and save them as JSP through the SSCE (Self Service Composition Environment). An attacker can inte CVE-2021-214818.8The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization ch CVE-2021-214828.3SAP NetWeaver Master Data Management, versions - 710, 710.750, allows a malicious unauthorized user with access to the MDM Server subnet to CVE-2021-214834.9Under certain conditions SAP Solution Manager, version - 720, allows a high privileged attacker to get access to sensitive information which CVE-2021-214849.8LDAP authentication in SAP HANA Database version 2.0 can be bypassed if the attached LDAP directory server is configured to enable unauthent CVE-2021-214856.5An unauthorized attacker may be able to entice an administrator to invoke telnet commands of an SAP NetWeaver Application Server for Java th CVE-2021-214868.8SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does not perform necessary CVE-2021-214878.8SAP Payment Engine version 500, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privil