Skip to content
CVE PROGRAM SOURCE RECORD9.9 Critical

CVE-2021-38176

Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sap

Description

Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query or inject ABAP code to gain access to Backend Database. On successful exploitation the threat actor could completely compromise confidentiality, integrity, and availability of the system.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP SE SAP S/4HANA

  • < 1511affected
  • < 1610affected
  • < 1709affected
  • < 1809affected
  • < 1909affected
  • < 2020affected
  • < 2021affected

SAP SE SAP LT Replication Server

  • < 2.0affected
  • < 3.0affected

SAP SE SAP LTRS for S/4HANA

  • < 1.0affected

SAP SE SAP Test Data Migration Server

  • < 4.0affected

SAP SE SAP Landscape Transformation

  • < 2.0affected

References