Critical severity · published Dec 14, 2021
CVE-2021-44231
Internally used text extraction reports allow an attacker to inject code that can be executed by the application
9.8
CVSS
1.4%
EPSS
No
On KEV
Description
Internally used text extraction reports allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
Abap Platform · Sap
701; 740; 750; 751; 752; 753; +4 more · source: NVD
NA
Netweaver Application Server Abap · Sap
701; 740; 750; 751; 752; 753; +4 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-44231
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-44231
Permissions Required
https://launchpad.support.sap.com/#/notes/3119365
Vendor Advisory
https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021
More from Abap Platform
8.8
CVE-2020-6296
SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 753, 755, allows an attacker to inject code that can be executed by the…
7.2
CVE-2024-22131
In SAP ABA (Application Basis) - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75I, an attacker authenticated as a user with a remote execution authorization can use a…
7.2
CVE-2020-6318
A Remote Code Execution vulnerability exists in the SAP NetWeaver (ABAP Server, up to release 7.40) and ABAP Platform (> release 7.40).Because of this, an attacker can exploit…
5.8
CVE-2020-6181
Under some circumstances the SAML SSO implementation in the SAP NetWeaver (SAP_BASIS versions 702, 730, 731, 740 and SAP ABAP Platform (SAP_BASIS versions 750, 751, 752, 753,…
5.4
CVE-2023-29110
The SAP Application Interface (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 100, 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows the usage HTML tags