CVE-2021-21469 Information disclosure in SAP NetWeaver Master Data Management
Attackers can exploit insecure MDS server configurations to perform SMB relay attacks and obtain sensitive data via UNC paths.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-21469?
CVE-2021-21469 is a medium-severity vulnerability in SAP NetWeaver Master Data Management, published on 12 Jan 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
When security guidelines for SAP NetWeaver Master Data Management running on windows have not been thoroughly reviewed, it might be possible for an external operator to try and set custom paths in the MDS server configuration. When no adequate protection has been enforced on any level (e.g., MDS Server password not set, network and OS configuration not properly secured, etc.), a malicious user might define UNC paths which could then be exploited to put the system at risk using a so-called SMB relay attack and obtain highly sensitive data, which leads to Information Disclosure.
Weakness: CWE-200
Which versions are affected by CVE-2021-21469?
It affects 1 product.
Products include Sap Netweaver Master Data Management.
How do I fix CVE-2021-21469?
No fix has been published for CVE-2021-21469 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-21469 being exploited?
There is no known exploitation of CVE-2021-21469 in the wild and no public exploit code.
Other vulnerabilities in SAP NetWeaver Master Data Management
Sources
Also known as GHSA-8r9q-9pvc-52xq.