Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveSapCVE-2021-33678
HistoryJul 14, 2021 - 12:15 p.m.

CVE-2021-33678

2021-07-1412:15:08
CWE-94
CWE-95
sap
web.nvd.nist.gov
57
5
sap
netweaver
as abap
reconciliation framework
cve-2021-33678
code injection
info deletion
nvd
vulnerability
security

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:N/I:P/A:C

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

AI Score

6.5

Confidence

High

EPSS

0.013

Percentile

85.9%

JSON

A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75B, 75C, 75D, 75E, 75F, allows a high privileged attacker to inject code that can be executed by the application. An attacker could thereby delete some critical information and could make the SAP system completely unavailable.

Affected configurations

Nvd
Node
sapnetweaver_application_server_abapMatch75a
OR
sapnetweaver_application_server_abapMatch75b
OR
sapnetweaver_application_server_abapMatch75c
OR
sapnetweaver_application_server_abapMatch75d
OR
sapnetweaver_application_server_abapMatch75e
OR
sapnetweaver_application_server_abapMatch75f
OR
sapnetweaver_application_server_abapMatch700
OR
sapnetweaver_application_server_abapMatch701
OR
sapnetweaver_application_server_abapMatch702
OR
sapnetweaver_application_server_abapMatch710
OR
sapnetweaver_application_server_abapMatch711
OR
sapnetweaver_application_server_abapMatch730
OR
sapnetweaver_application_server_abapMatch731
OR
sapnetweaver_application_server_abapMatch740
OR
sapnetweaver_application_server_abapMatch750
OR
sapnetweaver_application_server_abapMatch751
OR
sapnetweaver_application_server_abapMatch752
VendorProductVersionCPE
sapnetweaver_application_server_abap75acpe:2.3:a:sap:netweaver_application_server_abap:75a:*:*:*:*:*:*:*
sapnetweaver_application_server_abap75bcpe:2.3:a:sap:netweaver_application_server_abap:75b:*:*:*:*:*:*:*
sapnetweaver_application_server_abap75ccpe:2.3:a:sap:netweaver_application_server_abap:75c:*:*:*:*:*:*:*
sapnetweaver_application_server_abap75dcpe:2.3:a:sap:netweaver_application_server_abap:75d:*:*:*:*:*:*:*
sapnetweaver_application_server_abap75ecpe:2.3:a:sap:netweaver_application_server_abap:75e:*:*:*:*:*:*:*
sapnetweaver_application_server_abap75fcpe:2.3:a:sap:netweaver_application_server_abap:75f:*:*:*:*:*:*:*
sapnetweaver_application_server_abap700cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:*:*:*:*
sapnetweaver_application_server_abap701cpe:2.3:a:sap:netweaver_application_server_abap:701:*:*:*:*:*:*:*
sapnetweaver_application_server_abap702cpe:2.3:a:sap:netweaver_application_server_abap:702:*:*:*:*:*:*:*
sapnetweaver_application_server_abap710cpe:2.3:a:sap:netweaver_application_server_abap:710:*:*:*:*:*:*:*
Rows per page:
1-10 of 171

CNA Affected

[
  {
    "product": "SAP NetWeaver AS ABAP (Reconciliation Framework)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 700"
      },
      {
        "status": "affected",
        "version": "< 701"
      },
      {
        "status": "affected",
        "version": "< 702"
      },
      {
        "status": "affected",
        "version": "< 710"
      },
      {
        "status": "affected",
        "version": "< 711"
      },
      {
        "status": "affected",
        "version": "< 730"
      },
      {
        "status": "affected",
        "version": "< 731"
      },
      {
        "status": "affected",
        "version": "< 740"
      },
      {
        "status": "affected",
        "version": "< 750"
      },
      {
        "status": "affected",
        "version": "< 751"
      },
      {
        "status": "affected",
        "version": "< 752"
      },
      {
        "status": "affected",
        "version": "< 75A"
      },
      {
        "status": "affected",
        "version": "< 75B"
      },
      {
        "status": "affected",
        "version": "< 75C"
      },
      {
        "status": "affected",
        "version": "< 75D"
      },
      {
        "status": "affected",
        "version": "< 75E"
      },
      {
        "status": "affected",
        "version": "< 75F"
      }
    ]
  }
]

Social References

More

Related

nessus 1
prion 1
cvelist 1
nvd 1
packetstorm 1
nessus
nessus
SAP NetWeaver AS ABAP Code Injection (3048657)
2021-07-19 00:00:00
prion
prion
Design/Logic Flaw
2021-07-14 12:15:00
cvelist
cvelist
CVE-2021-33678
2021-07-14 11:04:19
nvd
nvd
CVE-2021-33678
2021-07-14 12:15:08
packetstorm
packetstorm
SAP Application Server ABAP / ABAP Platform Code Injection / SQL Injection / Missing Authorization
2022-05-19 00:00:00

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:N/I:P/A:C

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

AI Score

6.5

Confidence

High

EPSS

0.013

Percentile

85.9%

JSON
Related for CVE-2021-33678
nessus1prion1cvelist1nvd1packetstorm1