Vulnerability Details : CVE-2021-38163
SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.
Products affected by CVE-2021-38163
- cpe:2.3:a:sap:netweaver:7.30:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver:7.40:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver:7.31:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver:7.50:*:*:*:*:*:*:*
CVE-2021-38163 is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
SAP NetWeaver Unrestricted File Upload Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
SAP NetWeaver contains a vulnerability that allows unrestricted file upload.
Notes:
https://nvd.nist.gov/vuln/detail/CVE-2021-38163
Added on
2022-06-09
Action due date
2022-06-30
Exploit prediction scoring system (EPSS) score for CVE-2021-38163
92.17%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-38163
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.0
|
HIGH | AV:N/AC:L/Au:S/C:C/I:C/A:C |
8.0
|
10.0
|
NIST | |
|
9.9
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
3.1
|
6.0
|
SAP SE | |
|
9.9
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
3.1
|
6.0
|
SAP SE | |
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2021-38163
-
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.Assigned by: nvd@nist.gov (Primary)
References for CVE-2021-38163
-
https://launchpad.support.sap.com/#/notes/3084487
SAP ONE Support Launchpad: Log OnPermissions Required
-
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405
SAP Security Patch Day – September 2021 - Product Security Response at SAP - Community WikiVendor Advisory
Jump to