CVE-2021-41251

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

@sap-cloud-sdk/core contains the core functionality of the SAP Cloud SDK as well as the SAP Business Technology Platform abstractions. This affects applications on SAP Business Technology Platform that use the SAP Cloud SDK and enabled caching of destinations. In affected versions and in some cases, when user information was missing, destinations were cached without user information, allowing other users to retrieve the same destination with its permissions. By default, destination caching is disabled. The security for caching has been increased. The changes are released in version 1.52.0. Users unable to upgrade are advised to disable destination caching (it is disabled by default).

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Nov 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-412525.4Kirby is an open source file structured CMS ### Impact Kirby's writer field stores its formatted content as HTML code. Unlike with other fie CVE-2021-412538.1Zydis is an x86/x86-64 disassembler library. Users of Zydis versions v3.2.0 and older that use the string functions provided in `zycore` in CVE-2021-412548.8kustomize-controller is a Kubernetes operator, specialized in running continuous delivery pipelines for infrastructure and workloads defined CVE-2021-412567.1nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app CVE-2021-412585.4Kirby is an open source file structured CMS. In affected versions Kirby's blocks field stores structured data for each block. This data is t CVE-2021-41266.5When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a message footer added CVE-2021-412608.8Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 do n CVE-2021-412614.8Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are CVE-2021-412628.8Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are CVE-2021-412638.8rails_multisite provides multi-db support for Rails applications. In affected versions this vulnerability impacts any Rails applications usi CVE-2021-412649.8OpenZeppelin Contracts is a library for smart contract development. In affected versions upgradeable contracts using `UUPSUpgradeable` may b CVE-2021-412658.8Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability i