CVE-2021-38176
Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1511, 1610, 1709, 1809, 1909, and 6 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query or inject ABAP code to gain access to Backend Database. On successful exploitation the threat actor could completely compromise confidentiality, integrity, and availability of the system.
Timeline
- CVE published
- Record last updated
Affected versions
- SAP SE SAP S/4HANA
fixed in 1511; fixed in 1610; fixed in 1709; fixed in 1809; fixed in 1909; fixed in 2020; fixed in 2021
- SAP SE SAP LT Replication Server
fixed in 2.0; fixed in 3.0
- SAP SE SAP LTRS for S/4HANA
fixed in 1.0
- SAP SE SAP Test Data Migration Server
fixed in 4.0
- SAP SE SAP Landscape Transformation
fixed in 2.0