SAP SE Vulnerabilities and Affected Products
Vulnerabilities associated with SAP NetWeaver AS ABAP and ABAP Platform.
Products
Clear product- SAP 3D Visual Enterprise Viewer127 vulnerabilities
- SAP 3D Visual Enterprise Author27 vulnerabilities
- SAP Business One18 vulnerabilities
- SAP Disclosure Management13 vulnerabilities
- SAP Internet Graphics Server13 vulnerabilities
- SAP Business Objects Business Intelligence Platform12 vulnerabilities
- SAP HANA Extended Application Services12 vulnerabilities
- SAP Commerce10 vulnerabilities
- SAP Enable Now10 vulnerabilities
- SAP NetWeaver Enterprise Portal10 vulnerabilities
- SAP BusinessObjects Business Intelligence Platform9 vulnerabilities
- SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)9 vulnerabilities
- SAP Adaptive Server Enterprise7 vulnerabilities
- SAP Financial Consolidation7 vulnerabilities
- SAP Internet Graphics Service7 vulnerabilities
- SAP NetWeaver AS ABAP7 vulnerabilities
- SAP NetWeaver AS ABAP and ABAP Platform7 vulnerabilities
- SAP Cloud Connector6 vulnerabilities
- SAP HANA6 vulnerabilities
- SAP S/4HANA6 vulnerabilities
- SAP BusinessObjects Business Intelligence Platform (BI Workspace)5 vulnerabilities
- SAP Commerce Cloud5 vulnerabilities
- SAP Host Agent5 vulnerabilities
- SAP NetWeaver (ABAP Server) and ABAP Platform5 vulnerabilities
- SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server)5 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2021-40496MEDIUM | SAP Internet Communication framework (ICM) - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785, allows an attacker with logon functionality, to exploit the authentication function by using POST and form field to repeat executions of the initial command by a GET request and exposing sensitive data. This vulnerability is normally exposed over the network and successful exploitation can lead to exposure of data like system details. CWE-668Oct 12, 2021 | CVSS4.3v3.1 | EPSS0.95% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-38178HIGH | The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, enables a malicious user to transfer ABAP code artifacts or content, by-passing the established quality gates. By this vulnerability malicious code can reach quality and production, and can compromise the confidentiality, integrity, and availability of the system and its data. CWE-863Oct 12, 2021 | CVSS8.8v3.1 | EPSS1.29% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-40495MEDIUM | There are multiple Denial-of Service vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755. An unauthorized attacker can use the public SICF service /sap/public/bc/abap to reduce the performance of SAP NetWeaver Application Server ABAP and ABAP Platform. Oct 12, 2021 | CVSS5.3v3.1 | EPSS1.07% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-38181HIGH | SAP NetWeaver AS ABAP and ABAP Platform - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. CWE-400Oct 12, 2021 | CVSS7.5v3.1 | EPSS1.1% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-33684MEDIUM | SAP NetWeaver AS ABAP and ABAP Platform, versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 8.04, 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 8.04, 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.77, 7.81, 7.84, allows an attacker to send overlong content in the RFC request type thereby crashing the corresponding work process because of memory corruption vulnerability. The work process will attempt to … CWE-787Jul 14, 2021 | CVSS5.3v3.1 | EPSS0.985% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-33677HIGH | SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 702, 730, 731, 804, 740, 750, 784, expose functions to external which can lead to information disclosure. CWE-668Jul 14, 2021 | CVSS7.5v3.1 | EPSS0.935% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-27610CRITICAL | SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804, does not create information about internal and external RFC user in consistent and distinguished format, which could lead to improper authentication and may be exploited by malicious users to obtain illegitimate access to the system. CWE-287Jun 16, 2021 | CVSS9.8v3.1 | EPSS1.32% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |