cyfenced.com →

[ CVE-2021-38163 · Published 14 Sep 2021 ]

SAP NetWeaver Unrestricted File Upload Vulnerability

Exploited · CISA KEV CVSS 8.8 EPSS 37%No fix listed yet

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-06-09
  • EPSS: 37% chance of exploitation in the next 30 days (higher than 99% of CVEs)

[ Description ]Official description

SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.

CISA: SAP NetWeaver contains a vulnerability that allows unrestricted file upload.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 30 Jun 2022): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References