CVE-2021-21467

MEDIUM

SAP Banking Services - Missing Authorization for Business Partner Generic Market Data

Title source: llm
STIX 2.1

Description

SAP Banking Services (Generic Market Data) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. An unauthorized User is allowed to display restricted Business Partner Generic Market Data (GMD), due to improper authorization check.

References (2)

Core 2
Core References
Permissions Required, Vendor Advisory x_refsource_misc
https://launchpad.support.sap.com/#/notes/3008422

Scores

CVSS v3 4.3
EPSS 0.0010
EPSS Percentile 28.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-862
Status published
Products (1)
sap/banking_services
Published Jan 12, 2021
Tracked Since Feb 18, 2026