← Retour aux CVEs
CVE-2021-38163
CRITICALCISA KEV9.9
Description
SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.
Details CVE
Score CVSS v3.19.9
SeveriteCRITICAL
Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vecteur d'attaqueNETWORK
ComplexiteLOW
Privileges requisLOW
Interaction utilisateurNONE
Publie9/14/2021
Derniere modification2/25/2026
Sourcekev
Observations honeypot0
CISA KEV
FournisseurSAP
ProduitNetWeaver
Nom vulnerabiliteSAP NetWeaver Unrestricted File Upload Vulnerability
Date ajout KEV2022-06-09
Date limite remediation2022-06-30
Utilise dans ransomwareUnknown
Produits affectes
sap:netweaver
Faiblesses (CWE)
CWE-22CWE-22
References
https://launchpad.support.sap.com/#/notes/3084487(cna@sap.com)
https://launchpad.support.sap.com/#/notes/3084487(af854a3a-2127-422b-91ae-364da2661108)
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405(af854a3a-2127-422b-91ae-364da2661108)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38163(134c704f-9b21-4f2e-91b3-4a467353bcc0)
Correlations IOC
Aucune correlation enregistree
This product uses data from the NVD API but is not endorsed or certified by the NVD.