Medium severity6.5NVD Advisory· Published Feb 9, 2021· Updated Jun 17, 2026
CVE-2021-21474
CVE-2021-21474
Description
SAP HANA Database, versions - 1.0, 2.0, accepts SAML tokens with MD5 digest, an attacker who manages to obtain an MD5-digest signed SAML Assertion issued for an SAP HANA instance might be able to tamper with it and alter it in a way that the digest continues to be the same and without invalidating the digital signature, this allows them to impersonate as user in HANA database and be able to read the contents in the database.
Affected products
4(expand)+ 2 more
- (no CPE)
- cpe:2.3:a:sap:hana_database:1.00:*:*:*:*:*:*:*
- cpe:2.3:a:sap:hana_database:2.00:*:*:*:*:*:*:*
- SAP SE/SAP HANA Databasev5Range: < 1.0
Patches
Vulnerability mechanics
References
2- wiki.scn.sap.com/wiki/pages/viewpage.actionnvdVendor Advisory
- launchpad.support.sap.comnvdPermissions Required
News mentions
0No linked articles in our index yet.