CVE-2021-38176

published 2021-09-14

CVE-2021-38176: Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section…

Priority P3 55 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query or inject ABAP code to gain access to Backend Database. On successful exploitation the threat actor could completely compromise confidentiality, integrity, and availability of the system.

Affected

24 ranges

Vendor	Product	Version range	Fixed in
sap	landscape_transformation	—	—
sap	landscape_transformation_replication_server	—	—
sap	landscape_transformation_replication_server	—	—
sap	landscape_transformation_replication_server	—	—
sap	s_4hana	—	—
sap	s_4hana	—	—
sap	s_4hana	—	—
sap	s_4hana	—	—
sap	s_4hana	—	—
sap	s_4hana	—	—
sap	s_4hana	—	—
sap	test_data_migration_server	—	—
sap_se	sap_landscape_transformation	< 2.0	2.0
sap_se	sap_lt_replication_server	< 2.0	2.0
sap_se	sap_lt_replication_server	< 3.0	3.0
sap_se	sap_ltrs_for_s_4hana	< 1.0	1.0
sap_se	sap_s_4hana	< 1511	1511
sap_se	sap_s_4hana	< 1610	1610
sap_se	sap_s_4hana	< 1709	1709
sap_se	sap_s_4hana	< 1809	1809
sap_se	sap_s_4hana	< 1909	1909
sap_se	sap_s_4hana	< 2020	2020
sap_se	sap_s_4hana	< 2021	2021
sap_se	sap_test_data_migration_server	< 4.0	4.0

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v3.0 9.9 CRITICAL CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

nvd v2.0 9.0 CRITICAL AV:N/AC:L/Au:S/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89 CWE-20