PT-2021-20241 · Sap · Sap Netweaver As Abap

Published 2021-06-09 · Updated 2022-10-05 · CVE-2021-33663

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS ABAP versions 7.22 through 7.84

Description: The issue allows an unauthorized attacker to insert cleartext commands into encrypted SMTP sessions over the network due to improper restriction of I/O buffering. This can partially impact the integrity of the application.

Recommendations: For SAP NetWeaver AS ABAP versions 7.22 through 7.84, update to a version that properly restricts I/O buffering in encrypted SMTP sessions to prevent unauthorized insertion of cleartext commands.

Fix

Related Identifiers

CVE-2021-33663

Affected Products

Sap Netweaver As Abap

References · 4

• https://launchpad.support.sap.com/#/notes/3030604 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33663 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33663 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999 · Vendor Advisory