Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveSapCVE-2021-44235
HistoryDec 14, 2021 - 4:15 p.m.

CVE-2021-44235

2021-12-1416:15:09
CWE-78
sap
web.nvd.nist.gov
36
sap
netweaver
abap
code injection
cve-2021-44235
nvd
security vulnerability

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.9

Confidence

High

EPSS

0

Percentile

13.1%

JSON

Two methods of a utility class in SAP NetWeaver AS ABAP - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allow an attacker with high privileges and has direct access to SAP System, to inject code when executing with a certain transaction class builder. This could allow execution of arbitrary commands on the operating system, that could highly impact the Confidentiality, Integrity and Availability of the system.

Affected configurations

Nvd
Node
sapnetweaver_application_server_abapMatch700
OR
sapnetweaver_application_server_abapMatch701
OR
sapnetweaver_application_server_abapMatch702
OR
sapnetweaver_application_server_abapMatch710
OR
sapnetweaver_application_server_abapMatch711
OR
sapnetweaver_application_server_abapMatch730
OR
sapnetweaver_application_server_abapMatch731
OR
sapnetweaver_application_server_abapMatch740
OR
sapnetweaver_application_server_abapMatch750
OR
sapnetweaver_application_server_abapMatch751
OR
sapnetweaver_application_server_abapMatch752
OR
sapnetweaver_application_server_abapMatch753
OR
sapnetweaver_application_server_abapMatch754
OR
sapnetweaver_application_server_abapMatch755
OR
sapnetweaver_application_server_abapMatch756
VendorProductVersionCPE
sapnetweaver_application_server_abap700cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:*:*:*:*
sapnetweaver_application_server_abap701cpe:2.3:a:sap:netweaver_application_server_abap:701:*:*:*:*:*:*:*
sapnetweaver_application_server_abap702cpe:2.3:a:sap:netweaver_application_server_abap:702:*:*:*:*:*:*:*
sapnetweaver_application_server_abap710cpe:2.3:a:sap:netweaver_application_server_abap:710:*:*:*:*:*:*:*
sapnetweaver_application_server_abap711cpe:2.3:a:sap:netweaver_application_server_abap:711:*:*:*:*:*:*:*
sapnetweaver_application_server_abap730cpe:2.3:a:sap:netweaver_application_server_abap:730:*:*:*:*:*:*:*
sapnetweaver_application_server_abap731cpe:2.3:a:sap:netweaver_application_server_abap:731:*:*:*:*:*:*:*
sapnetweaver_application_server_abap740cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:*:*:*:*
sapnetweaver_application_server_abap750cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:*:*:*:*
sapnetweaver_application_server_abap751cpe:2.3:a:sap:netweaver_application_server_abap:751:*:*:*:*:*:*:*
Rows per page:
1-10 of 151

CNA Affected

[
  {
    "product": "SAP NetWeaver AS ABAP",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 700"
      },
      {
        "status": "affected",
        "version": "< 701"
      },
      {
        "status": "affected",
        "version": "< 702"
      },
      {
        "status": "affected",
        "version": "< 710"
      },
      {
        "status": "affected",
        "version": "< 711"
      },
      {
        "status": "affected",
        "version": "< 730"
      },
      {
        "status": "affected",
        "version": "< 731"
      },
      {
        "status": "affected",
        "version": "< 740"
      },
      {
        "status": "affected",
        "version": "< 750"
      },
      {
        "status": "affected",
        "version": "< 751"
      },
      {
        "status": "affected",
        "version": "< 752"
      },
      {
        "status": "affected",
        "version": "< 753"
      },
      {
        "status": "affected",
        "version": "< 754"
      },
      {
        "status": "affected",
        "version": "< 755"
      },
      {
        "status": "affected",
        "version": "< 756"
      }
    ]
  }
]

Related

nessus 2
cvelist 1
prion 1
nvd 1
nessus
nessus
SAP NetWeaver AS ABAP and Code Injection (3123196)
2022-05-30 00:00:00
SAP NetWeaver AS ABAP Code Injection (December 2021)
2021-12-21 00:00:00
cvelist
cvelist
CVE-2021-44235
2021-12-14 15:44:09
prion
prion
Code injection
2021-12-14 16:15:00
nvd
nvd
CVE-2021-44235
2021-12-14 16:15:09

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.9

Confidence

High

EPSS

0

Percentile

13.1%

JSON
Related for CVE-2021-44235
nessus2cvelist1prion1nvd1