VDB
CVE-2021-21485
CVE-2021-21485
PUBLISHED
CVSS 7.4 HIGH
Reported by sap · Published April 13, 2021
An unauthorized attacker may be able to entice an administrator to invoke telnet commands of an SAP NetWeaver Application Server for Java that allow the attacker to gain NTLM hashes of a privileged user.
Risk scores
CVSS 3.0
7.4
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP NetWeaver AS for JAVA (Telnet Commands) | ENGINEAPI 7.30, 7.31, 7.40, 7.50, ESP_FRAMEWORK 7.10, 7.20, 7.30, 7.31, 7.40, 7.50, SERVERCORE 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 |
| SAP SE | SAP NetWeaver AS for JAVA (Telnet Commands) | ENGINEAPI 7.30, 7.31, 7.40, 7.50, ESP_FRAMEWORK 7.10, 7.20, 7.30, 7.31, 7.40, 7.50, SERVERCORE 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 |
Timeline
- Apr 13, 2021 CVE Published
- Apr 14, 2021 EPSS Score (30 in total, the first dated here)
- Aug 3, 2024 CVE Updated
- Jun 1, 2026 Security Advisory
- Aug 26, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2021-21485
vulnetix vdb fixes CVE-2021-21485Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2021-21485/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart