by Kastro
Paper/Archive/CVE-2021-21484

CVE-2021-21484

SAP SE SAP HANA — LDAP authentication in SAP HANA Database version 2.0 can be bypassed if the attached LDAP directory server is configured to enable unauth…

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 69.4.694 × 2013.9No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

LDAP authentication in SAP HANA Database version 2.0 can be bypassed if the attached LDAP directory server is configured to enable unauthenticated bind.

Affected

ProductAffectedFixed inSource
SAP HANA< 2.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
sap (CNA)7.7CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

References

refwiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107reflaunchpad.support.sap.com/#/notes/3017378