Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query or inject ABAP code to gain access to Backend Database. On successful exploitation the threat actor could completely compromise confidentiality, integrity, and availability of the system.
References
| Link | Resource |
|---|---|
| https://launchpad.support.sap.com/#/notes/3089831 | Permissions Required |
| https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 | Vendor Advisory |
| https://launchpad.support.sap.com/#/notes/3089831 | Permissions Required |
| https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 06:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://launchpad.support.sap.com/#/notes/3089831 - Permissions Required | |
| References | () https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 - Vendor Advisory |
12 Jul 2022, 17:42
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-89 |
30 Nov 2021, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query or inject ABAP code to gain access to Backend Database. On successful exploitation the threat actor could completely compromise confidentiality, integrity, and availability of the system. |
27 Sep 2021, 20:59
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 - Vendor Advisory | |
| References | (MISC) https://launchpad.support.sap.com/#/notes/3089831 - Permissions Required | |
| CPE | cpe:2.3:a:sap:s\/4hana:2021:*:*:*:*:*:*:* cpe:2.3:a:sap:s\/4hana:2020:*:*:*:*:*:*:* cpe:2.3:a:sap:s\/4hana:1511:*:*:*:*:*:*:* cpe:2.3:a:sap:s\/4hana:1909:*:*:*:*:*:*:* cpe:2.3:a:sap:landscape_transformation_replication_server:2.0:*:*:*:*:*:*:* cpe:2.3:a:sap:s\/4hana:1809:*:*:*:*:*:*:* cpe:2.3:a:sap:landscape_transformation:2.0:*:*:*:*:*:*:* cpe:2.3:a:sap:s\/4hana:1610:*:*:*:*:*:*:* cpe:2.3:a:sap:test_data_migration_server:4.0:*:*:*:*:*:*:* cpe:2.3:a:sap:landscape_transformation_replication_server:1.0:*:*:*:*:s\/4hana:*:* cpe:2.3:a:sap:s\/4hana:1709:*:*:*:*:*:*:* cpe:2.3:a:sap:landscape_transformation_replication_server:3.0:*:*:*:*:*:*:* |
|
| CWE | CWE-20 | |
| CVSS |
v2 : v3 : |
v2 : 9.0
v3 : 8.8 |
14 Sep 2021, 13:01
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-09-14 12:15
Updated : 2024-11-21 06:16
NVD link : CVE-2021-38176
Mitre link : CVE-2021-38176
CVE.ORG link : CVE-2021-38176
JSON object : View
Products Affected
sap
- landscape_transformation
- landscape_transformation_replication_server
- test_data_migration_server
- s\/4hana
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')