PT-2021-24073 · Sap · Sap Netweaver As Abap

Published 2021-12-14 · Updated 2022-10-06 · CVE-2021-44235

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS ABAP versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756

Description: The issue allows an attacker with high privileges and direct access to the SAP System to inject code when executing a certain transaction class builder. This could enable the execution of arbitrary commands on the operating system, potentially highly impacting the Confidentiality, Integrity, and Availability of the system.

Recommendations: For SAP NetWeaver AS ABAP versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, consider restricting access to the utility class methods to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-44235

Affected Products

Sap Netweaver As Abap

References · 4

• https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44235 · Security Note
• https://osv.dev/vulnerability/CVE-2021-44235 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3123196 · Note