CVE-2021-21482

HighCVSS 8.3/10Last modified Jun 17, 2026

Description

SAP NetWeaver Master Data Management, versions - 710, 710.750, allows a malicious unauthorized user with access to the MDM Server subnet to find the password using a brute force method. If successful, the attacker could obtain access to highly sensitive data and MDM administrative privileges leading to information disclosure vulnerability thereby affecting the confidentiality and integrity of the application. This happens when security guidelines and recommendations concerning administrative accounts of an SAP NetWeaver Master Data Management installation have not been thoroughly reviewed.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Affected software

Vendor	Product	Versions
SAP SE	SAP NetWeaver Master Data Management	< 710; < 710.750

References

https://launchpad.support.sap.com/#/notes/3017908Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649Vendor Advisory
https://launchpad.support.sap.com/#/notes/3017908Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649Vendor Advisory

Timeline

Published: Apr 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-214834.9Under certain conditions SAP Solution Manager, version - 720, allows a high privileged attacker to get access to sensitive information which CVE-2021-214849.8LDAP authentication in SAP HANA Database version 2.0 can be bypassed if the attached LDAP directory server is configured to enable unauthent CVE-2021-214856.5An unauthorized attacker may be able to entice an administrator to invoke telnet commands of an SAP NetWeaver Application Server for Java th CVE-2021-214868.8SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does not perform necessary CVE-2021-214878.8SAP Payment Engine version 500, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privil CVE-2021-214886.5Knowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with basic privileges to deserialize user-controll CVE-2021-214894.8SAP NetWeaver Enterprise Portal versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user related data, resulti CVE-2021-21492.5Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is CVE-2021-214906.1SAP NetWeaver AS for ABAP (Web Survey), versions - 700, 702, 710, 711, 730, 731, 750, 750, 752, 75A, 75F, does not sufficiently encode input CVE-2021-214916.1SAP Netweaver Application Server Java (Applications based on WebDynpro Java) versions 7.00, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allow CVE-2021-214924.3SAP NetWeaver Application Server Java(HTTP Service), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate log CVE-2021-214933.3When a user opens manipulated Graphics Interchange Format (.GIF) format files received from untrusted sources in SAP 3D Visual Enterprise Vi