Vulnerability CVE-2021-33678


Published: 2021-07-14

Description:
A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75B, 75C, 75D, 75E, 75F, allows a high privileged attacker to inject code that can be executed by the application. An attacker could thereby delete some critical information and could make the SAP system completely unavailable.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
SAP Application Server ABAP / ABAP Platform Code Injection / SQL Injection / Missing Authorization
Fabian Hagg
22.05.2022

Type:

CWE-94

(Improper Control of Generation of Code ('Code Injection'))

CVSS2 => (AV:N/AC:L/Au:S/C:N/I:P/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
7.8/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
None
Partial
Complete
Affected software
SAP -> Netweaver as abap 

 References:
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506
https://launchpad.support.sap.com/#/notes/3048657

Copyright 2024, cxsecurity.com

 

Back to Top