PT-2021-22905 · Sap · Sap Cloud Print Manager+2

Published 2021-10-12 · Updated 2021-10-18 · CVE-2021-40499

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server for ABAP versions 7.70, 7.70 PI, 7.70 BYD

Description The client-side printing services SAP Cloud Print Manager and SAPSprint allow an attacker to inject code that can be executed by the application, potentially controlling the behavior of the application.

Recommendations For versions 7.70, 7.70 PI, 7.70 BYD, update to a version that includes a fix for this issue to prevent code injection attacks. As a temporary workaround, consider restricting access to the client-side printing services to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2021-40499

Affected Products

Sap Cloud Print Manager

Sap Netweaver Application Server Abap

Sapsprint

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-40499 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-40499 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3100882 · Note
• https://t.me/cibsecurity/30422 · Telegram Post