CVE-2021-21488

MEDIUM

SAP NetWeaver Knowledge Management 7.01-7.50 - Authenticated Remote Code Execution via Insecure Deserialization

Title source: llm
STIX 2.1

Description

Knowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with basic privileges to deserialize user-controlled data without verification, leading to insecure deserialization which triggers the attacker’s code, therefore impacting Availability.

References (2)

Core 2
Core References
Permissions Required, Vendor Advisory x_refsource_misc
https://launchpad.support.sap.com/#/notes/2983436

Scores

CVSS v3 6.5
EPSS 0.0065
EPSS Percentile 71.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-502
Status published
Products (6)
sap/netweaver_knowledge_management 7.01
sap/netweaver_knowledge_management 7.02
sap/netweaver_knowledge_management 7.30
sap/netweaver_knowledge_management 7.31
sap/netweaver_knowledge_management 7.40
sap/netweaver_knowledge_management 7.50
Published Mar 09, 2021
Tracked Since Feb 18, 2026