Lucene search

SapCVE-2021-33663

HistoryJun 09, 2021 - 2:15 p.m.

CVE-2021-33663

2021-06-0914:15:10

sap

web.nvd.nist.gov

cve-2021-33663

sap netweaver

as abap

unauthorized access

smtp

network security

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

38.7%

JSON

SAP NetWeaver AS ABAP, versions - KRNL32NUC - 7.22,7.22EXT, KRNL32UC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73,7.77,7.81,7.82,7.83,7.84, allows an unauthorized attacker to insert cleartext commands due to improper restriction of I/O buffering into encrypted SMTP sessions over the network which can partially impact the integrity of the application.

Affected configurations

Nvd

Node

sapnetweaver_application_server_abapMatchkernel_7.22

sapnetweaver_application_server_abapMatchkernel_7.49

sapnetweaver_application_server_abapMatchkernel_7.53

sapnetweaver_application_server_abapMatchkernel_7.73

sapnetweaver_application_server_abapMatchkernel_7.77

sapnetweaver_application_server_abapMatchkernel_7.81

sapnetweaver_application_server_abapMatchkernel_7.82

sapnetweaver_application_server_abapMatchkernel_7.83

sapnetweaver_application_server_abapMatchkernel_7.84

sapnetweaver_application_server_abapMatchkernel_8.04

sapnetweaver_application_server_abapMatchkrnl32nuc_7.22

sapnetweaver_application_server_abapMatchkrnl32nuc_7.22ext

sapnetweaver_application_server_abapMatchkrnl32uc_7.22

sapnetweaver_application_server_abapMatchkrnl32uc_7.22ext

sapnetweaver_application_server_abapMatchkrnl64nuc_7.22

sapnetweaver_application_server_abapMatchkrnl64nuc_7.22ext

sapnetweaver_application_server_abapMatchkrnl64nuc_7.49

sapnetweaver_application_server_abapMatchkrnl64uc_7.22

sapnetweaver_application_server_abapMatchkrnl64uc_7.22ext

sapnetweaver_application_server_abapMatchkrnl64uc_7.49

sapnetweaver_application_server_abapMatchkrnl64uc_7.53

sapnetweaver_application_server_abapMatchkrnl64uc_7.73

sapnetweaver_application_server_abapMatchkrnl64uc_8.04

VendorProductVersionCPE
sapnetweaver_application_server_abapkernel_7.22cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.22:*:*:*:*:*:*:*
sapnetweaver_application_server_abapkernel_7.49cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.49:*:*:*:*:*:*:*
sapnetweaver_application_server_abapkernel_7.53cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.53:*:*:*:*:*:*:*
sapnetweaver_application_server_abapkernel_7.73cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.73:*:*:*:*:*:*:*
sapnetweaver_application_server_abapkernel_7.77cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.77:*:*:*:*:*:*:*
sapnetweaver_application_server_abapkernel_7.81cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.81:*:*:*:*:*:*:*
sapnetweaver_application_server_abapkernel_7.82cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.82:*:*:*:*:*:*:*
sapnetweaver_application_server_abapkernel_7.83cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.83:*:*:*:*:*:*:*
sapnetweaver_application_server_abapkernel_7.84cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.84:*:*:*:*:*:*:*
sapnetweaver_application_server_abapkernel_8.04cpe:2.3:a:sap:netweaver_application_server_abap:kernel_8.04:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sap	netweaver_application_server_abap	kernel_7.22	cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.22:::::::*
sap	netweaver_application_server_abap	kernel_7.49	cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.49:::::::*
sap	netweaver_application_server_abap	kernel_7.53	cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.53:::::::*
sap	netweaver_application_server_abap	kernel_7.73	cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.73:::::::*
sap	netweaver_application_server_abap	kernel_7.77	cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.77:::::::*
sap	netweaver_application_server_abap	kernel_7.81	cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.81:::::::*
sap	netweaver_application_server_abap	kernel_7.82	cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.82:::::::*
sap	netweaver_application_server_abap	kernel_7.83	cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.83:::::::*
sap	netweaver_application_server_abap	kernel_7.84	cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.84:::::::*
sap	netweaver_application_server_abap	kernel_8.04	cpe:2.3:a:sap:netweaver_application_server_abap:kernel_8.04:::::::*

Rows per page:

1-10 of 231

CNA Affected

[
  {
    "product": "SAP NetWeaver AS ABAP",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< KRNL32NUC - 7.22"
      },
      {
        "status": "affected",
        "version": "< 7.22EXT"
      },
      {
        "status": "affected",
        "version": "< KRNL32UC - 7.22"
      },
      {
        "status": "affected",
        "version": "< KRNL64NUC - 7.22"
      },
      {
        "status": "affected",
        "version": "< 7.49"
      },
      {
        "status": "affected",
        "version": "< KRNL64UC - 8.04"
      },
      {
        "status": "affected",
        "version": "< 7.22"
      },
      {
        "status": "affected",
        "version": "< 7.53"
      },
      {
        "status": "affected",
        "version": "< 7.73"
      },
      {
        "status": "affected",
        "version": "< KERNEL - 7.22"
      },
      {
        "status": "affected",
        "version": "< 8.04"
      },
      {
        "status": "affected",
        "version": "< 7.77"
      },
      {
        "status": "affected",
        "version": "< 7.81"
      },
      {
        "status": "affected",
        "version": "< 7.82"
      },
      {
        "status": "affected",
        "version": "< 7.83"
      },
      {
        "status": "affected",
        "version": "< 7.84"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/3030604

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

38.7%

JSON

Related for CVE-2021-33663