Lucene search

K
cve[email protected]CVE-2021-38176
HistorySep 14, 2021 - 12:15 p.m.

CVE-2021-38176

2021-09-1412:15:11
CWE-89
web.nvd.nist.gov
26
2
cve-2021-38176
input sanitization
remote code execution
abap code injection
confidentiality compromise
integrity compromise
availability compromise
nvd

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.8%

Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query or inject ABAP code to gain access to Backend Database. On successful exploitation the threat actor could completely compromise confidentiality, integrity, and availability of the system.

Affected configurations

NVD
Node
saplandscape_transformationMatch2.0
OR
saplandscape_transformation_replication_serverMatch1.0s\/4hana
OR
saplandscape_transformation_replication_serverMatch2.0
OR
saplandscape_transformation_replication_serverMatch3.0
OR
saps\/4hanaMatch1511
OR
saps\/4hanaMatch1610
OR
saps\/4hanaMatch1709
OR
saps\/4hanaMatch1809
OR
saps\/4hanaMatch1909
OR
saps\/4hanaMatch2020
OR
saps\/4hanaMatch2021
OR
saptest_data_migration_serverMatch4.0

CNA Affected

[
  {
    "product": "SAP S/4HANA",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 1511"
      },
      {
        "status": "affected",
        "version": "< 1610"
      },
      {
        "status": "affected",
        "version": "< 1709"
      },
      {
        "status": "affected",
        "version": "< 1809"
      },
      {
        "status": "affected",
        "version": "< 1909"
      },
      {
        "status": "affected",
        "version": "< 2020"
      },
      {
        "status": "affected",
        "version": "< 2021"
      }
    ]
  },
  {
    "product": "SAP LT Replication Server",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 2.0"
      },
      {
        "status": "affected",
        "version": "< 3.0"
      }
    ]
  },
  {
    "product": "SAP LTRS for S/4HANA",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.0"
      }
    ]
  },
  {
    "product": "SAP Test Data Migration Server",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 4.0"
      }
    ]
  },
  {
    "product": "SAP Landscape Transformation",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 2.0"
      }
    ]
  }
]

Social References

More

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.8%

Related for CVE-2021-38176