On 09.02.2021 a security relevant correction has been released by SAP SE. The manufacturer resolves an issue within SAP Netweaver.
SAP Note 2998173 addresses "[CVE-2021-21472] Server password not set during installation of SAP NetWeaver Master Data Management 7.1" to prevent insufficient security function with a medium risk for exploitation.
A workaround does not exist, according to SAP Security Advisory team. It is advisable to implement the correction as part of maintenance, the team suggests.
Risk specificationDuring the installation of an SAP NetWeaver Master Data Management (MDM) system using Software Provisioning Manager (SWPM) there is no option to set a server password.
During any MDM installation process using SWPM, a password dialog window will be prompted so that the user has the option of setting an MDM password as soon as MDS is started.
SAP NetWeaver is a common foundation for many enterprise solutions offered by SAP SE. The most common modules SAP ERP, SAP HCM, SAP APO etc. are based on SAP NW.
The advisory is valid for
- SOFTWARE_PROVISIONING_MANAGER 1.0
- 5.4 [CVE-2020-6178] Insufficient session expiration in SAP Enable Now Manager
- 3.8 [CVE-2020-6197] Insufficient session expiration in SAP Enable Now Manager
- 3.7 [CVE-2020-6363] Insufficient Session Expiration in SAP Commerce Cloud
- 3.5 [CVE-2021-33689] Insufficient Logging in SAP NetWeaver AS for JAVA (Administrator)
- 3.4 [CVE-2021-27612] SAP GUI for Windows is vulnerable to redirect users to an untrusted website