CVE-2021-37531

Katalog CVE

CVSS 8.8 · High EPSS 3,2%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada sap netweaver knowledge management xml forms. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

SAP NetWeaver Knowledge Management XML Forms versions - 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, contains an XSLT vulnerability which allows a non-administrative authenticated attacker to craft a malicious XSL stylesheet file containing a script with OS-level commands, copy it into a location to be accessed by the system and then create a file which will trigger the XSLT engine to execute the script contained within the malicious XSL file. This can result in a full compromise of the confidentiality, integrity, and availability of the system.

Rincian

Terbit di NVD

14 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

3,2% peluang dieksploitasi; lebih tinggi dari 87,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 advisory vendor
• http://packetstormsecurity.com/files/165751/SAP-Enterprise-Portal-XSLT-Injection.html advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2022/Jan/75 mailing list · advisory pihak ketiga
• https://launchpad.support.sap.com/#/notes/3081888 permissions required