Improper Input Sanitization in SAP Products Allows Remote Code Execution

CVE-2021-38176

What is CVE-2021-38176?

This vulnerability arises from insufficient input sanitization within SAP NetWeaver, enabling authenticated users with specific privileges to remotely invoke NZDT function modules. This capability allows for the execution of manipulated queries or the injection of ABAP code, potentially leading to unauthorized access to the backend database. Successful exploitation can severely undermine the confidentiality, integrity, and availability of the affected systems, highlighting the critical need for prompt remediation.

References