Veille CVE
CVE-2021-38163
8.8 Élevée Exploitée activementCatalogue CISA KEV — SAP NetWeaver Unrestricted File Upload Vulnerability
Ajoutée le 09/06/2022 · Échéance de correction (agences US) : 30/06/2022
Action requise : Apply updates per vendor instructions.
Description
SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 9.9 Critique | cna@sap.com | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| 3.1 | 8.8 Élevée | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | 9.0 Élevée | nvd@nist.gov (NVD) | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Faiblesses (CWE)
Références
- https://launchpad.support.sap.com/#/notes/3084487 Permissions Required
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 Broken LinkVendor Advisory
- https://launchpad.support.sap.com/#/notes/3084487 Permissions Required
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 Broken LinkVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38163 US Government Resource