CVE-2021-21488 Deserialization in SAP NetWeaver Knowledge Management

Medium 6.5 Published 9 Mar 2021 Updated 3 Aug 2024

Remote attackers with basic privileges can execute arbitrary code via insecure deserialization in SAP NetWeaver Knowledge Management, impacting availability.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-21488?

CVE-2021-21488 is a medium-severity unsafe deserialization vulnerability in SAP NetWeaver Knowledge Management, published on 9 Mar 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Knowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with basic privileges to deserialize user-controlled data without verification, leading to insecure deserialization which triggers the attacker’s code, therefore impacting Availability.

Weakness: CWE-502

Which versions are affected by CVE-2021-21488?

It affects 1 product.

Products include Sap Netweaver Knowledge Management.

How do I fix CVE-2021-21488?

No fix has been published for CVE-2021-21488 yet. Limit exposure of the affected software until one is available.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2021-21488 being exploited?

There is no known exploitation of CVE-2021-21488 in the wild and no public exploit code.

Sources

Also known as GHSA-g2rh-3q72-5cq4.