← Back to CVEs
CVE-2021-38163
CRITICALCISA KEV9.9
Description
SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.
CVE Details
CVSS v3.1 Score9.9
SeverityCRITICAL
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack VectorNETWORK
ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
Published9/14/2021
Last Modified2/25/2026
Sourcekev
Honeypot Sightings0
CISA KEV
VendorSAP
ProductNetWeaver
Vulnerability NameSAP NetWeaver Unrestricted File Upload Vulnerability
KEV Date Added2022-06-09
Remediation Due Date2022-06-30
Ransomware UseUnknown
Affected Products
sap:netweaver
Weaknesses (CWE)
CWE-22CWE-22
References
https://launchpad.support.sap.com/#/notes/3084487(cna@sap.com)
https://launchpad.support.sap.com/#/notes/3084487(af854a3a-2127-422b-91ae-364da2661108)
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405(af854a3a-2127-422b-91ae-364da2661108)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38163(134c704f-9b21-4f2e-91b3-4a467353bcc0)
IOC Correlations
No correlations recorded
This product uses data from the NVD API but is not endorsed or certified by the NVD.