CVE-2021-38178

CWE-863 — Incorrect Authorization3 documents3 sources
Severity
8.8HIGH
EPSS
0.5%
top 32.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
SAP SE SAP Netweaver AS Abap AND Abap PlatformSAP Netweaver AbapSAP Netweaver Application Server Abap
Timeline
PublishedOct 12
Latest updateMay 24

Description

The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, enables a malicious user to transfer ABAP code artifacts or content, by-passing the established quality gates. By this vulnerability malicious code can reach quality and production, and can compromise the confidentiality, integrity, and availability of the system and its data.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶NVDsap/netweaver_abap14 versions+13
▶NVDsap/netweaver_application14 versions+13

🔴Vulnerability Details

2
GHSA
GHSA-mg95-qw85-jrq5: The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 7↗2022-05-24
▶
CVEList
CVE-2021-38178: The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 7↗2021-10-12
▶
CVE-2021-38178 (HIGH CVSS 8.8) | The software logistics system of SA | cvebase.io