CVE-2021-33678
Summary
| CVE | CVE-2021-33678 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-07-14 12:15:00 UTC |
| Updated | 2022-10-05 14:16:00 UTC |
| Description | A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75B, 75C, 75D, 75E, 75F, allows a high privileged attacker to inject code that can be executed by the application. An attacker could thereby delete some critical information and could make the SAP system completely unavailable. |
Risk And Classification
Problem Types: CWE-95
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Sap | Netweaver Application Server Abap | 700 | All | All | All |
| Application | Sap | Netweaver Application Server Abap | 701 | All | All | All |
| Application | Sap | Netweaver Application Server Abap | 702 | All | All | All |
| Application | Sap | Netweaver Application Server Abap | 710 | All | All | All |
| Application | Sap | Netweaver Application Server Abap | 711 | All | All | All |
| Application | Sap | Netweaver Application Server Abap | 730 | All | All | All |
| Application | Sap | Netweaver Application Server Abap | 731 | All | All | All |
| Application | Sap | Netweaver Application Server Abap | 740 | All | All | All |
| Application | Sap | Netweaver Application Server Abap | 750 | All | All | All |
| Application | Sap | Netweaver Application Server Abap | 751 | All | All | All |
| Application | Sap | Netweaver Application Server Abap | 752 | All | All | All |
| Application | Sap | Netweaver Application Server Abap | 75a | All | All | All |
| Application | Sap | Netweaver Application Server Abap | 75b | All | All | All |
| Application | Sap | Netweaver Application Server Abap | 75c | All | All | All |
| Application | Sap | Netweaver Application Server Abap | 75d | All | All | All |
| Application | Sap | Netweaver Application Server Abap | 75e | All | All | All |
| Application | Sap | Netweaver Application Server Abap | 75f | All | All | All |
| Application | Sap | Netweaver As Abap | 700 | All | All | All |
| Application | Sap | Netweaver As Abap | 701 | All | All | All |
| Application | Sap | Netweaver As Abap | 702 | All | All | All |
| Application | Sap | Netweaver As Abap | 710 | All | All | All |
| Application | Sap | Netweaver As Abap | 711 | All | All | All |
| Application | Sap | Netweaver As Abap | 730 | All | All | All |
| Application | Sap | Netweaver As Abap | 731 | All | All | All |
| Application | Sap | Netweaver As Abap | 740 | All | All | All |
| Application | Sap | Netweaver As Abap | 750 | All | All | All |
| Application | Sap | Netweaver As Abap | 751 | All | All | All |
| Application | Sap | Netweaver As Abap | 752 | All | All | All |
| Application | Sap | Netweaver As Abap | 75a | All | All | All |
| Application | Sap | Netweaver As Abap | 75b | All | All | All |
| Application | Sap | Netweaver As Abap | 75c | All | All | All |
| Application | Sap | Netweaver As Abap | 75d | All | All | All |
| Application | Sap | Netweaver As Abap | 75e | All | All | All |
| Application | Sap | Netweaver As Abap | 75f | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| launchpad.support.sap.com | MISC | launchpad.support.sap.com | |
| SAP Application Server ABAP / ABAP Platform Code Injection / SQL Injection / Missing Authorization ≈ Packet Storm | MISC | packetstormsecurity.com | |
| SAP Security Patch Day – July 2021 - Product Security Response at SAP - Community Wiki | MISC | wiki.scn.sap.com | |
| Full Disclosure: SEC Consult SA-20220518-0 :: Multiple Critical Vulnerabilities in SAP® Application Server, ABAP and ABAP® Platform (Different Software Components) | FULLDISC | seclists.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 87521 SAP NetWeaver AS ABAP Command Execution Vulnerability (3048657)