CVE-2021-38176 - Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query or inject ABAP code to gain access to Backend Database

Back Back to CVE browser

HIGH

Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query or inject ABAP code to gain access to Backend Database

Published Sep 14, 2021

8.8

HIGH

CVSS 3.1

EPSS 1.27%

Description

Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query or inject ABAP code to gain access to Backend Database. On successful exploitation the threat actor could completely compromise confidentiality, integrity, and availability of the system.

Affected products

Vendor SAP SE Product SAP LT Replication Server Default
n/a
- Version
  < 2.0
  Status
  affected
  Constraints
  -
- Version
  < 3.0
  Status
  affected
  Constraints
  -
Vendor SAP SE Product SAP LTRS for S/4HANA Default
n/a
- Version
  < 1.0
  Status
  affected
  Constraints
  -
Vendor SAP SE Product SAP Landscape Transformation Default
n/a
- Version
  < 2.0
  Status
  affected
  Constraints
  -
Vendor SAP SE Product SAP S/4hana Default
n/a
- Version
  < 1511
  Status
  affected
  Constraints
  -
- Version
  < 1610
  Status
  affected
  Constraints
  -
- Version
  < 1709
  Status
  affected
  Constraints
  -
- Version
  < 1809
  Status
  affected
  Constraints
  -
- Version
  < 1909
  Status
  affected
  Constraints
  -
- Version
  < 2020
  Status
  affected
  Constraints
  -
- Version
  < 2021
  Status
  affected
  Constraints
  -
Vendor SAP SE Product SAP Test Data Migration Server Default
n/a
- Version
  < 4.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SAP SE

SAP LT Replication Server

n/a

Version	Status	Constraints
< 2.0	affected	-
< 3.0	affected	-

SAP SE

SAP LTRS for S/4HANA

n/a

Version	Status	Constraints
< 1.0	affected	-

SAP SE

SAP Landscape Transformation

n/a

Version	Status	Constraints
< 2.0	affected	-

SAP SE

SAP S/4hana

n/a

Version	Status	Constraints
< 1511	affected	-
< 1610	affected	-
< 1709	affected	-
< 1809	affected	-
< 1909	affected	-
< 2020	affected	-
< 2021	affected	-

SAP SE

SAP Test Data Migration Server

n/a

Version	Status	Constraints
< 4.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-24646
Advisory
https://launchpad.support.sap.com/#/notes/3089831
x_refsource_MISCPermissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-24646		Advisory
https://launchpad.support.sap.com/#/notes/3089831		x_refsource_MISCPermissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405		x_refsource_MISCVendor Advisory