Log in Start free

Vulnerability · Published Sep 15, 2021 · Assigned by sap

CVE-2021-33701

Critical 9.1

In plain English

A critical-severity SQL injection in DMIS Mobile Plug-In from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities).

Severity (CVSS 3.0)9.1Critical
Exploit odds (30 days)2.1%top 18.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 710, 2011_1_752, 2020, SAPSCORE 125, S4CORE 102, 102, 103, 104, 105, allows an attacker with access to highly privileged account to execute manipulated query in NDZT tool to gain access to Superuser account, leading to SQL Injection vulnerability, that highly impacts systems Confidentiality, Integrity and Availability.

Affected products (as reported)

VendorProductVersions
SAP SE DMIS Mobile Plug-In < DMIS 2011_1_620< 2011_1_640< 2011_1_700< 2011_1_710< 2011_1_730< 710< 2011_1_731< 2011_1_752
SAP SE SAP S/4HANA < SAPSCORE 125< S4CORE 102< 102< 103< 104< 105

Weakness: CWE-89 · Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References