Actively exploited · Published Sep 14, 2021 · Assigned by sap
CVE-2021-38163
Critical 9.9 Exploited
In plain English
A critical-severity path traversal in SAP NetWeaver (Visual Composer 7.0 RT) from SAP SE. Attackers are actively exploiting it in the wild (listed by CISA on June 9, 2022). The chance it is exploited in the next 30 days is estimated at 36.9% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jun 30, 2022.
Official description
SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP NetWeaver (Visual Composer 7.0 RT) | 7.307.317.407.50 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 x_refsource_MISC
- https://launchpad.support.sap.com/#/notes/3084487 x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38163 government-resource