CVE-2021-33678

A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75B, 75C, 75D, 75E, 75F, allows a high privileged attacker to inject code that can be executed by the application. An attacker could thereby delete some critical information and could make the SAP system completely unavailable.

• CWE-95
• CWE-94

• http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/May/42Exploit, Mailing List, Third Party Advisory
• https://launchpad.support.sap.com/#/notes/3048657Permissions Required
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506Vendor Advisory
• http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/May/42Exploit, Mailing List, Third Party Advisory
• https://launchpad.support.sap.com/#/notes/3048657Permissions Required
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506Vendor Advisory

Published

Jul 14, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33672Due to missing encoding in SAP Contact Center's Communicatio…9.6
• CVE-2021-33673Under certain conditions, SAP Contact Center - version 700,d…6.1
• CVE-2021-33674Under certain conditions, SAP Contact Center - version 700, …6.1
• CVE-2021-33675Under certain conditions, SAP Contact Center - version 700, …6.1
• CVE-2021-33676A missing authority check in SAP CRM, versions - 700, 701, 7…7.2
• CVE-2021-33677SAP NetWeaver ABAP Server and ABAP Platform, versions - 700,…7.5
• CVE-2021-33679The SAP BusinessObjects BI Platform version - 420 allows an …5.4
• CVE-2021-33680SAP 3D Visual Enterprise Viewer, version - 9, allows a user …6.5
• CVE-2021-33681SAP 3D Visual Enterprise Viewer, version - 9, allows a user …6.5
• CVE-2021-33682SAP Lumira Server version 2.4 does not sufficiently encode u…5.4
• CVE-2021-33683SAP Web Dispatcher and Internet Communication Manager (ICM),…4.3
• CVE-2021-33684SAP NetWeaver AS ABAP and ABAP Platform, versions - KRNL32NU…5.3