CVE-2021-38176
High
Description
Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query or inject ABAP code to gain access to Backend Database. On successful exploitation the threat actor could completely compromise confidentiality, integrity, and availability of the system.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Sap Landscape Transformation
PublishedSep 14, 2021
First seenSep 14, 2021
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sap landscape_transformation | 2.0 | — |
| sap landscape_transformation_replication_server | 1.0, 2.0, 3.0 | — |
| sap s\/4hana | 1511, 1610, 1709, 1809, 1909, 2020, 2021 | — |
| sap test_data_migration_server | 4.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.