CVE-2021-33678

Katalog CVE

CVSS 6.5 · Medium EPSS 2,5%

Kerentanan Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') pada sap netweaver application server abap. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75B, 75C, 75D, 75E, 75F, allows a high privileged attacker to inject code that can be executed by the application. An attacker could thereby delete some critical information and could make the SAP system completely unavailable.

Rincian

Terbit di NVD

14 Juli 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

2,5% peluang dieksploitasi; lebih tinggi dari 84,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 advisory vendor
• http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injec... exploit · advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2022/May/42 exploit · mailing list · advisory pihak ketiga
• https://launchpad.support.sap.com/#/notes/3048657 permissions required