CVE-2021-21467

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-01-12 · updated 2026-06-17
Weakness: CWE-862

Description

SAP Banking Services (Generic Market Data) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. An unauthorized User is allowed to display restricted Business Partner Generic Market Data (GMD), due to improper authorization check.

Affected products

SAP SE SAP Banking Services: all versions

References

https://launchpad.support.sap.com/#/notes/3008422
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476
https://launchpad.support.sap.com/#/notes/3008422
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476

Get alerted when CVE-2021-21467 or the next vulnerability affects your stack