CVE-2021-38176 CRITICAL

CVE-2021-38176

Vendor Sap Se
Product SAP S/4HANA
Published September 14, 2021
Last update August 4, 2024

CVSS base score

9.9/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query or inject ABAP code to gain access to Backend Database. On successful exploitation the threat actor could completely compromise confidentiality, integrity, and availability of the system.

Key dates

02Disclosure timeline

September 14, 2021 CVE published
August 4, 2024 Record updated