CVE-2021-38178

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-38178
The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, enables a malicious user to transfer ABAP code artifacts or content, by-passing the established quality gates. By this vulnerability malicious code can reach quality and production, and can compromise the confidentiality, integrity, and availability of the system and its data.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://launchpad.support.sap.com/#/notes/3097887 Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983 Vendor Advisory
https://launchpad.support.sap.com/#/notes/3097887 Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sap:netweaver_abap:700:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_abap:701:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_abap:702:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_abap:710:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_abap:730:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_abap:731:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_abap:740:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_abap:750:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_abap:751:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_abap:752:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_abap:753:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_abap:754:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_abap:755:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_abap:756:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:701:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:702:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:710:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:730:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:731:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:751:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:752:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:753:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:754:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:755:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:756:*:*:*:*:*:*:*
History

21 Nov 2024, 06:16

Type Values Removed Values Added
References () https://launchpad.support.sap.com/#/notes/3097887 - Permissions Required () https://launchpad.support.sap.com/#/notes/3097887 - Permissions Required
References () https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983 - Vendor Advisory () https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983 - Vendor Advisory

12 Jul 2022, 17:42

Type Values Removed Values Added
CWE CWE-863 NVD-CWE-Other

19 Oct 2021, 00:50

Type Values Removed Values Added
References (MISC) https://launchpad.support.sap.com/#/notes/3097887 - (MISC) https://launchpad.support.sap.com/#/notes/3097887 - Permissions Required
References (MISC) https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983 - (MISC) https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983 - Vendor Advisory
CWE CWE-863
CVSS v2 : unknown
v3 : unknown 		v2 : 6.5
v3 : 8.8
CPE cpe:2.3:a:sap:netweaver_abap:731:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:701:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:730:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:754:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:702:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:710:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:751:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_abap:750:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_abap:700:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:731:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_abap:753:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_abap:740:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_abap:752:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:740:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_abap:751:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:753:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:750:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:700:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_abap:755:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_abap:710:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_abap:754:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_abap:756:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:755:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_abap:730:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:752:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_abap:701:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_abap:702:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:756:*:*:*:*:*:*:*

12 Oct 2021, 15:17

Type Values Removed Values Added
New CVE
Information

Published : 2021-10-12 15:15

Updated : 2024-11-21 06:16

NVD link : CVE-2021-38178

Mitre link : CVE-2021-38178

CVE.ORG link : CVE-2021-38178

JSON object : View

Products Affected

sap

  • netweaver_abap
  • netweaver_application_server_abap
CWE
NVD-CWE-Other