PT-2021-6087 · Sap · Sap Netweaver As Abap+1

Published 2021-10-12 · Updated 2022-10-06 · CVE-2021-38178

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS ABAP and ABAP Platform versions 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756

Description The software logistics system enables a malicious user to transfer ABAP code artifacts or content, bypassing the established quality gates. This can allow malicious code to reach quality and production, compromising the confidentiality, integrity, and availability of the system and its data. The issue is related to incorrect authorization, which can be exploited by a remote attacker to execute arbitrary code.

Recommendations For SAP NetWeaver AS ABAP and ABAP Platform versions 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, consider implementing additional authorization checks to prevent bypassing of quality gates. As a temporary workaround, consider restricting access to the software logistics system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2022-00741

CVE-2021-38178

Affected Products

Abap Platform

Sap Netweaver As Abap

References · 6

• https://bdu.fstec.ru/vul/2022-00741 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38178 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38178 · Security Note
• https://launchpad.support.sap.com/#/notes/3097887 · Note
• https://t.me/cibsecurity/30417 · Telegram Post