Improper Input Sanitization in SAP Products Allows Remote Code Execution
CVE-2021-38176

9.9CRITICAL

Key Information:

Vendor
SAP
Status
SAP S/4hana
SAP Lt Replication Server
SAP Ltrs For S/4hana
SAP Test Data Migration Server
Vendor
CVE Published:
14 September 2021

Summary

This vulnerability arises from insufficient input sanitization within SAP NetWeaver, enabling authenticated users with specific privileges to remotely invoke NZDT function modules. This capability allows for the execution of manipulated queries or the injection of ABAP code, potentially leading to unauthorized access to the backend database. Successful exploitation can severely undermine the confidentiality, integrity, and availability of the affected systems, highlighting the critical need for prompt remediation.

Affected Version(s)

SAP Landscape Transformation < 2.0

SAP LT Replication Server < 2.0 < 2.0

SAP LT Replication Server < 3.0 < 3.0

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/3089831
x_refsource_MISC

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.