Code Injection Vulnerability in SAP Cloud Printing Services
CVE-2021-40499

9.8CRITICAL

Key Information:

Vendor
SAP
Status
SAP Netweaver Application Server For Abap (SAP Cloud Print Manager And SAPsprint)
Vendor
CVE Published:
12 October 2021

Summary

The SAP Cloud Print Manager and SAPSprint for the SAP NetWeaver Application Server for ABAP versions 7.70, 7.70 PI, and 7.70 BYD are susceptible to a code injection vulnerability. This flaw allows attackers to inject malicious code that can be executed by the application, potentially compromising its functionality and security. Exploiting this vulnerability grants an attacker control over the application's behavior, which may lead to unauthorized actions and data breaches.

Affected Version(s)

SAP NetWeaver Application Server for ABAP (SAP Cloud Print Manager and SAPSprint) < 7.70 < 7.70

SAP NetWeaver Application Server for ABAP (SAP Cloud Print Manager and SAPSprint) < 7.70 PI < 7.70 PI

SAP NetWeaver Application Server for ABAP (SAP Cloud Print Manager and SAPSprint) < 7.70BYD < 7.70BYD

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/3100882
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.