CVE-2021-38178 Business logic in SAP NetWeaver AS ABAP and ABAP Platform
A malicious user can bypass quality gates to transfer ABAP code into production, compromising system confidentiality, integrity, and availability.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-38178?
CVE-2021-38178 is a high-severity vulnerability in Sap Netweaver Application Server Abap, published on 12 Oct 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, enables a malicious user to transfer ABAP code artifacts or content, by-passing the established quality gates. By this vulnerability malicious code can reach quality and production, and can compromise the confidentiality, integrity, and availability of the system and its data.
Which versions are affected by CVE-2021-38178?
It affects 2 products.
Products include Sap Netweaver Abap, Sap Netweaver Application Server Abap.
How do I fix CVE-2021-38178?
No fix has been published for CVE-2021-38178 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-38178 being exploited?
There is no known exploitation of CVE-2021-38178 in the wild and no public exploit code.
Other vulnerabilities in Sap Netweaver Application Server Abap
- CVE-2012-4341 Memory corruption in n/a
- CVE-2021-27610 Auth bypass in SAP NetWeaver AS ABAP and ABAP Platform
- CVE-2022-22543 Denial of service in SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel)
- CVE-2021-38181 Denial of service in SAP NetWeaver AS ABAP and ABAP Platform
- CVE-2021-27597 Denial of service in SAP NetWeaver AS for ABAP (RFC Gateway)
Sources
Also known as GHSA-mg95-qw85-jrq5.