CVE-2021-38163 SAP NetWeaver Unrestricted File Upload
Authenticated attackers can upload malicious files to SAP NetWeaver Visual Composer to execute OS commands, read/modify data, or cause denial of service.
- Exploited in the wild
- Since 9 Jun 2022
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-38163?
CVE-2021-38163 is a critical vulnerability in Sap Netweaver, published on 14 Sep 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.
Weakness: CWE-22
Which versions are affected by CVE-2021-38163?
It affects 1 product.
Products include Sap Netweaver.
How do I fix CVE-2021-38163?
No fix has been published for CVE-2021-38163 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 30 Jun 2022.
Is CVE-2021-38163 being exploited?
Yes. Attackers have exploited CVE-2021-38163 in the wild since at least 9 Jun 2022.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Sap Netweaver
Sources
Also known as GHSA-px4v-wj8p-cq36.