PT-2021-21985 · Sap · Sap Nzdt

Published 2021-09-14 · Updated 2022-07-12 · CVE-2021-38176

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SAP NZDT (affected versions not specified)

Description: The issue arises from improper input sanitization, allowing an authenticated user with specific privileges to remotely execute manipulated queries or inject ABAP code, thereby gaining access to the Backend Database. Successful exploitation could lead to a complete compromise of the system's confidentiality, integrity, and availability.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-38176

Affected Products

Sap Nzdt

References · 7

• https://osv.dev/vulnerability/CVE-2021-38176 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38176 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 · Vendor Advisory
• https://t.me/isacarusec/4439 · Telegram Post
• https://t.me/cibsecurity/28809 · Telegram Post
• https://launchpad.support.sap.com/#/notes/3089831 · Note
• https://t.me/true_secator/2111 · Telegram Post