Read the docs
TI-2021-04569 Aliases CVE-2021-21471

In CLA-Assistant, versions before 2.8.5, due to improper access control an authenticated…

Priority LOW 30Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

In CLA-Assistant, versions before 2.8.5, due to improper access control an authenticated user could access API endpoints which are not intended to be used by the user. This could impact the integrity of the application.

Why it matters now

EPSS 0.00738 54th percentileScored 2026-11-07
Fix Fixed CLA-Assistant (SAP SE): 2.8.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPCLA-Assistantbefore 2.8.52.8.5Patch availableCNA
  • CLA-Assistant VendorSAP Affected before 2.8.5 Fixed in 2.8.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sap:cla-assistant:*:*:*:*:*:*:*:*before 2.8.5VulnerableSAP
  • cpe:2.3:a:sap:cla-assistant:*:*:*:*:*:*:*:* Versions before 2.8.5 Vulnerable ·SAP

Remediation

  • Fix · CNA CLA-Assistant (SAP SE) Fixed in 2.8.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21471

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences