CVE-2021-21475

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-02-09 · updated 2026-06-17
Weakness: CWE-22

Description

Under specific circumstances SAP Master Data Management, versions - 710, 710.750, allows an unauthorized attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs. Due to this Directory Traversal vulnerability the attacker could read content of arbitrary files on the remote server and expose sensitive data.

Affected products

SAP SE SAP NetWeaver Master Data Management Server: 710, 710.750

References

https://launchpad.support.sap.com/#/notes/3000897
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543
https://launchpad.support.sap.com/#/notes/3000897
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543

Get alerted when CVE-2021-21475 or the next vulnerability affects your stack