CVE-2021-21485

State: Published
Severity: 7.4 High
Published: Apr 13, 2021
Updated: Aug 3, 2024
Reserved: Dec 30, 2020

Description

An unauthorized attacker may be able to entice an administrator to invoke telnet commands of an SAP NetWeaver Application Server for Java that allow the attacker to gain NTLM hashes of a privileged user.

Scores

CVSS	Score	Vector	Source
3.0	7.4 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N	sap

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
SAP NetWeaver AS for JAVA (Telnet Commands)SAP SE	ENGINEAPI 7.30, 7.31, 7.40, 7.50Affected ESP_FRAMEWORK 7.10, 7.20, 7.30, 7.31, 7.40, 7.50Affected SERVERCORE 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50Affected J2EE-FRMW 7.10, 7.20, 7.30, 7.31, 7.40, 7.50Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.