CVE-2021-33701criticalCWE-89

CVE-2021-33701: falha crítica em SAP SE DMIS Mobile Plug-In

Publicada em · Atualizada em

48Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 9.1epss 2.1%
probabilidade de exploração
2.1%top 19% das CVEs
exploração observada
nãonenhuma fonte reporta
2 exploit(s) público(s)
DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 710, 2011_1_752, 2020, SAPSCORE 125, S4CORE 102, 102, 103, 104, 105, allows an attacker with access to highly privileged account to execute manipulated query in NDZT tool to gain access to Superuser account, leading to SQL Injection vulnerability, that highly impacts systems Confidentiality, Integrity and Availability.
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
SAP SE · DMIS Mobile Plug-InSAP SE · SAP S/4HANA
PoCs públicas encontradas — 2
cve_referencepacketstormsecurity.com/files/165303/SAP-Netweaver-IUUC_RECON_RC_COUNT_TABLE_BIG-SQL-Injection.htmlnão verificadocve_referencepacketstormsecurity.com/files/165304/SAP-Netweaver-IUUC_RECON_RC_COUNT_TABLE_BIG-ABAP-Code-Injection.htmlnão verificado
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — SAP SE DMIS Mobile Plug-In

No mesmo produto, das mais perigosas para as menos.

CVE-2021-38176CRITICALCVE-2021-38176EPSS 1.3%CVE-2022-22530—CVE-2022-22530EPSS 0.9%CVE-2022-22531—CVE-2022-22531EPSS 0.8%CVE-2022-32248—CVE-2022-32248EPSS 0.7%CVE-2022-31597—CVE-2022-31597EPSS 0.4%
Referências
http://packetstormsecurity.com/files/165303/SAP-Netweaver-IUUC_RECON_RC_COUNT_TABLE_BIG-SQL-Injection.htmlhttp://packetstormsecurity.com/files/165304/SAP-Netweaver-IUUC_RECON_RC_COUNT_TABLE_BIG-ABAP-Code-Injection.htmlhttp://seclists.org/fulldisclosure/2021/Dec/35http://seclists.org/fulldisclosure/2021/Dec/36https://launchpad.support.sap.com/#/notes/3078312https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806