CVE-2021-38178

high-risk

Published 2021-10-12

The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, enables a malicious user to transfer ABAP code artifacts or content, by-passing the established quality gates. By this vulnerability malicious code can reach quality and production, and can compromise the confidentiality, integrity, and availability of the system and its data.

Do I need to act?

0.54% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.8/10 High

NETWORK / LOW complexity

Affected Products (20)

Netweaver Abap

Netweaver Application Server Abap

Affected Vendors

Sap

References (4)

Permissions Required https://launchpad.support.sap.com/#/notes/3097887

Vendor Advisory https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983

Permissions Required https://launchpad.support.sap.com/#/notes/3097887

Vendor Advisory https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983

/ 100

high-risk

Severity 30/34 · Critical

Exploitability 2/34 · Minimal

Exposure 22/34 · High