CVE-2021-38176

State: Published
Severity: 9.9 Critical
Published: Sep 14, 2021
Updated: Aug 4, 2024
Reserved: Aug 7, 2021

Description

Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query or inject ABAP code to gain access to Backend Database. On successful exploitation the threat actor could completely compromise confidentiality, integrity, and availability of the system.

Scores

CVSS	Score	Vector	Source
3.0	9.9 Critical	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	sap

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
SAP S/4HANASAP SE	< 1511Affected < 1610Affected < 1709Affected < 1809Affected < 1909Affected < 2020Affected < 2021Affected
SAP LT Replication ServerSAP SE	< 2.0Affected < 3.0Affected
SAP LTRS for S/4HANASAP SE	< 1.0Affected
SAP Test Data Migration ServerSAP SE	< 4.0Affected
SAP Landscape TransformationSAP SE	< 2.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.