by Kastro
Paper/Archive/CVE-2021-21481

CVE-2021-21481

SAP SE SAP NetWeaver AS JAVA (MigrationService) — The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization…

EPSS 0.5%CVSS 9.6
critical.is priorityof 100
37
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 43.1.431 × 208.6No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization check. This might allow an unauthorized attacker to access configuration objects, including such that grant administrative privileges. This could result in complete compromise of system confidentiality, integrity, and availability.

Affected

ProductAffectedFixed inSource
SAP NetWeaver AS JAVA (MigrationService)< 7.10–CNA
SAP NetWeaver AS JAVA (MigrationService)< 7.11–CNA
SAP NetWeaver AS JAVA (MigrationService)< 7.30–CNA
SAP NetWeaver AS JAVA (MigrationService)< 7.31–CNA
SAP NetWeaver AS JAVA (MigrationService)< 7.40–CNA
SAP NetWeaver AS JAVA (MigrationService)< 7.50–CNA

Scores by source

sap (CNA)9.6CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

reflaunchpad.support.sap.com/#/notes/3022422refwiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107