Strix
26.1K

CVE-2021-38176

HIGHCVSS 8.8/10EPSS 1.23%

Last modified

CVE-2021-38176 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query or inject ABAP code to gain access to Backend Database. On successful exploitation the threat actor could completely compromise confidentiality, integrity, and availability of the system.. EPSS estimates a 1.23% chance of exploitation in the next 30 days.

Description

Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query or inject ABAP code to gain access to Backend Database. On successful exploitation the threat actor could completely compromise confidentiality, integrity, and availability of the system.

Metrics

CVSS 3.1
8.8/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
1.23%

65.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
SapLandscape Transformation2.0
SapLandscape Transformation Replication Server1.0
SapLandscape Transformation Replication Server2.0
SapLandscape Transformation Replication Server3.0
SapS\/4hana1511
SapS\/4hana1610
SapS\/4hana1709
SapS\/4hana1809
SapS\/4hana1909
SapS\/4hana2020
SapS\/4hana2021
SapTest Data Migration Server4.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2021-38176?
Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query or inject ABAP code to gain access to Backend Database. On successful exploitation the threat actor could completely compromise confidentiality, integrity, and availability of the system.
How severe is CVE-2021-38176?
CVE-2021-38176 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 1.23% probability of exploitation in the next 30 days.
How do I fix CVE-2021-38176?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-38176?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST