CVE-2021-21473

SAP NetWeaver AS ABAP and ABAP Platform, versions - 700, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, contains function module SRM_RFC_SUBMIT_REPORT which fails to validate authorization of an authenticated user thus allowing an unauthorized user to execute reports in SAP NetWeaver ABAP Platform.

• CWE-862

• http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/May/42Exploit, Mailing List, Third Party Advisory
• https://launchpad.support.sap.com/#/notes/3002517Permissions Required, Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999Vendor Advisory
• http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/May/42Exploit, Mailing List, Third Party Advisory
• https://launchpad.support.sap.com/#/notes/3002517Permissions Required, Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999Vendor Advisory

Published

Jun 9, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-21468The BW Database Interface does not perform necessary authori…6.5
• CVE-2021-21469When security guidelines for SAP NetWeaver Master Data Manag…7.5
• CVE-2021-2147Vulnerability in the Oracle ZFS Storage Appliance Kit produc…1.8
• CVE-2021-21470SAP EPM Add-in for Microsoft Office, version - 1010 and SAP …4.4
• CVE-2021-21471In CLA-Assistant, versions before 2.8.5, due to improper acc…6.5
• CVE-2021-21472SAP Software Provisioning Manager 1.0 (SAP NetWeaver Master …8.8
• CVE-2021-21474SAP HANA Database, versions - 1.0, 2.0, accepts SAML tokens …6.5
• CVE-2021-21475Under specific circumstances SAP Master Data Management, ver…7.5
• CVE-2021-21476SAP UI5 versions before 1.38.49, 1.52.49, 1.60.34, 1.71.31, …6.1
• CVE-2021-21477SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, ena…9.9
• CVE-2021-21478SAP Web Dynpro ABAP allow an attacker to redirect users to a…6.1
• CVE-2021-21479In SCIMono before 0.0.19, it is possible for an attacker to …9.1