CVE-2021-38163criticalunder attackCWE-22

CVE-2021-38163: critical vulnerability in SAP NetWeaver (Visual Composer 7.0 RT)

Published · Updated

Follow this CVE+ Monitor SAP NetWeaver

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

90Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 9.9epss 37%
from disclosure to weapon361 days
Published on NVDSep 14
1st PoC+361d
CISA KEV+268d
Action required by CISAfederal deadline: 2022-06-30

Apply updates per vendor instructions.

In short

A flaw in SAP NetWeaver allows a regular user to upload a malicious file that runs as the Java Server, letting attackers steal data, modify files, or crash the system.

Technical detail

CWE-22 path traversal vulnerability in SAP NetWeaver Visual Composer 7.0 RT (versions 7.30–7.50) permits authenticated non-admin users to upload and execute arbitrary files with Java Server privileges. The attacker can achieve remote code execution to read/modify sensitive data or perform denial of service attacks.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
SAP SE · SAP NetWeaver (Visual Composer 7.0 RT)
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.