CVE-2021-21473 : Security Advisory and Response

SAP NetWeaver AS ABAP and ABAP Platform versions 700 to 755 are affected by a vulnerability that allows an unauthorized user to execute reports due to the failure to validate authorization of an authenticated user in the function module SRM_RFC_SUBMIT_REPORT.

Understanding CVE-2021-21473

This CVE relates to a security issue in SAP NetWeaver AS ABAP and ABAP Platform, impacting versions 700 to 755.

What is CVE-2021-21473?

The vulnerability in CVE-2021-21473 enables unauthorized users to execute reports in SAP NetWeaver ABAP Platform by bypassing authentication validation.

The Impact of CVE-2021-21473

With a CVSS base score of 6.3, this medium-severity vulnerability poses a threat to the confidentiality, integrity, and availability of affected systems.

Technical Details of CVE-2021-21473

This section provides an overview of the vulnerability in terms of description, affected systems, and exploitation mechanism.

Vulnerability Description

The vulnerability arises from the lack of authorization validation for authenticated users, allowing unauthorized users to run reports in SAP NetWeaver ABAP Platform.

Affected Systems and Versions

SAP NetWeaver AS ABAP and ABAP Platform versions < 700 to < 755 are affected by this vulnerability.

Exploitation Mechanism

By leveraging the security gap in the validation process, attackers can exploit this vulnerability to execute unauthorized reports in affected systems.

Mitigation and Prevention

To address CVE-2021-21473, immediate steps, long-term security practices, and patching recommendations are crucial.

Immediate Steps to Take

Organizations should review and apply the necessary security patches provided by SAP to mitigate the vulnerability and secure their systems.

Long-Term Security Practices

Implementing strict authentication and authorization mechanisms, conducting regular security assessments, and staying informed about security advisories are essential long-term security practices.

Patching and Updates

Regularly updating SAP NetWeaver AS ABAP and ABAP Platform to the latest secure versions is critical in preventing exploitation of known vulnerabilities.