Vulnerability Details : CVE-2021-33663
SAP NetWeaver AS ABAP, versions - KRNL32NUC - 7.22,7.22EXT, KRNL32UC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73,7.77,7.81,7.82,7.83,7.84, allows an unauthorized attacker to insert cleartext commands due to improper restriction of I/O buffering into encrypted SMTP sessions over the network which can partially impact the integrity of the application.
Products affected by CVE-2021-33663
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.49:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.53:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.77:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.81:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.84:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:krnl64nuc_7.49:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_7.49:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_7.53:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:krnl64nuc_7.22:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.22:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_7.22:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_8.04:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_8.04:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:krnl32nuc_7.22:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.73:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.82:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:kernel_7.83:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:krnl32nuc_7.22ext:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:krnl32uc_7.22:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:krnl32uc_7.22ext:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:krnl64nuc_7.22ext:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_7.22ext:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_7.73:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-33663
0.19%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 38 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-33663
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:N |
10.0
|
2.9
|
NIST | |
|
5.8
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N |
3.9
|
1.4
|
SAP SE | |
|
5.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
3.9
|
1.4
|
NIST |
References for CVE-2021-33663
-
https://launchpad.support.sap.com/#/notes/3030604
SAP ONE Support Launchpad: Log OnPermissions Required;Vendor Advisory
-
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999
SAP Security Patch Day – June 2021 - Product Security Response at SAP - Community WikiVendor Advisory
Jump to