Medium severity · published Feb 9, 2021
CVE-2021-21474
SAP HANA Database, versions - 1.0, 2.0, accepts SAML tokens with MD5 digest, an attacker who manages to obtain an MD5-digest signed SAML Assertion issued for an SAP HANA instance…
6.5
CVSS
0.7%
EPSS
No
On KEV
Description
SAP HANA Database, versions - 1.0, 2.0, accepts SAML tokens with MD5 digest, an attacker who manages to obtain an MD5-digest signed SAML Assertion issued for an SAP HANA instance might be able to tamper with it and alter it in a way that the digest continues to be the same and without invalidating the digital signature, this allows them to impersonate as user in HANA database and be able to read the contents in the database.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HD
Hana Database · Sap
1.00; 2.00 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-21474
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-21474
Permissions Required
https://launchpad.support.sap.com/#/notes/2992154
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543
More from Hana Database
9.8
CVE-2023-40309
SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation…
8.8
CVE-2026-0492
Privilege escalation vulnerability in SAP HANA database
7.5
CVE-2023-40308
SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library which in turn causes…
7.5
CVE-2019-0350
SAP HANA Database, versions 1.0, 2.0, allows an unauthorized attacker to send a malformed connection request, which crashes the indexserver of an SAP HANA instance, leading to…
7.5
CVE-2018-2424
SAP UI5 did not validate user input before adding it to the DOM structure