CVE-2021-38176 vulnerability in SAP Products
Published on September 14, 2021
Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query or inject ABAP code to gain access to Backend Database. On successful exploitation the threat actor could completely compromise confidentiality, integrity, and availability of the system.
Products Associated with CVE-2021-38176
Want to know whenever a new CVE is published for SAP products? stack.watch will email you.
Affected Versions
SAP SE SAP S/4HANA:- Version < 1511 is affected.
- Version < 1610 is affected.
- Version < 1709 is affected.
- Version < 1809 is affected.
- Version < 1909 is affected.
- Version < 2020 is affected.
- Version < 2021 is affected.
- Version < 2.0 is affected.
- Version < 3.0 is affected.
- Version < 1.0 is affected.
- Version < 4.0 is affected.
- Version < 2.0 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.