critical9.9Known exploited
CVE-2021-38163
SAP NetWeaver Unrestricted File Upload Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-06-09. Federal due date: 2022-06-30.
Apply updates per vendor instructions.
Impact
SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sap | Netweaver | Versions 7.30, 7.31, 7.40, 7.50 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://launchpad.support.sap.com/#/notes/3084487
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405
- https://launchpad.support.sap.com/#/notes/3084487
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38163