Lucene search

[email protected]CVE-2021-44231

HistoryDec 14, 2021 - 4:15 p.m.

CVE-2021-44231

2021-12-1416:15:09

CWE-94

[email protected]

web.nvd.nist.gov

cve-2021-44231

text extraction

code injection

application behavior

security vulnerability

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.006

Percentile

77.7%

JSON

Internally used text extraction reports allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.

Affected configurations

NVD

Node

sapabap_platformMatch701

sapabap_platformMatch740

sapabap_platformMatch750

sapabap_platformMatch751

sapabap_platformMatch752

sapabap_platformMatch753

sapabap_platformMatch754

sapabap_platformMatch755

sapabap_platformMatch756

sapabap_platformMatch804

sapnetweaver_application_server_abapMatch701

sapnetweaver_application_server_abapMatch740

sapnetweaver_application_server_abapMatch750

sapnetweaver_application_server_abapMatch751

sapnetweaver_application_server_abapMatch752

sapnetweaver_application_server_abapMatch753

sapnetweaver_application_server_abapMatch754

sapnetweaver_application_server_abapMatch755

sapnetweaver_application_server_abapMatch756

sapnetweaver_application_server_abapMatch804

VendorProductVersionCPE
sapabap_platform804cpe:/a:sap:abap_platform:804:::
sapabap_platform752cpe:/a:sap:abap_platform:752:::
sapnetweaver_application_server_abap752cpe:/a:sap:netweaver_application_server_abap:752:::
sapabap_platform754cpe:/a:sap:abap_platform:754:::
sapabap_platform756cpe:/a:sap:abap_platform:756:::
sapabap_platform751cpe:/a:sap:abap_platform:751:::
sapabap_platform701cpe:/a:sap:abap_platform:701:::
sapabap_platform750cpe:/a:sap:abap_platform:750:::
sapabap_platform753cpe:/a:sap:abap_platform:753:::
sapnetweaver_application_server_abap750cpe:/a:sap:netweaver_application_server_abap:750:::

Vendor	Product	Version	CPE
sap	abap_platform	804	cpe:/a:sap:abap_platform:804:::
sap	abap_platform	752	cpe:/a:sap:abap_platform:752:::
sap	netweaver_application_server_abap	752	cpe:/a:sap:netweaver_application_server_abap:752:::
sap	abap_platform	754	cpe:/a:sap:abap_platform:754:::
sap	abap_platform	756	cpe:/a:sap:abap_platform:756:::
sap	abap_platform	751	cpe:/a:sap:abap_platform:751:::
sap	abap_platform	701	cpe:/a:sap:abap_platform:701:::
sap	abap_platform	750	cpe:/a:sap:abap_platform:750:::
sap	abap_platform	753	cpe:/a:sap:abap_platform:753:::
sap	netweaver_application_server_abap	750	cpe:/a:sap:netweaver_application_server_abap:750:::

Rows per page:

1-10 of 201

CNA Affected

[
  {
    "product": "SAP ABAP Server & ABAP Platform (Translation Tools)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 701"
      },
      {
        "status": "affected",
        "version": "< 740"
      },
      {
        "status": "affected",
        "version": "< 750"
      },
      {
        "status": "affected",
        "version": "< 751"
      },
      {
        "status": "affected",
        "version": "< 752"
      },
      {
        "status": "affected",
        "version": "< 753"
      },
      {
        "status": "affected",
        "version": "< 754"
      },
      {
        "status": "affected",
        "version": "< 755"
      },
      {
        "status": "affected",
        "version": "< 756"
      },
      {
        "status": "affected",
        "version": "< 804"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/3119365

wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021

Social References

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.006

Percentile

77.7%

JSON

Related for CVE-2021-44231

nessus1 prion1 cvelist1 nvd1