CVE-2021-38163
Assigner: sap
Published: 2021-09-14T11:21:36
State: PUBLISHED
affected: defaultStatus: unaffected
product: SAP NetWeaver (Visual Composer 7.0 RT)
vendor: SAP SE
versions: status: affected
version: 7.30
status: affected
version: 7.31
status: affected
version: 7.40
status: affected
version: 7.50
descriptions: supportingMedia: base64: no
type: text/html
value: <p>SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.</p>
value: SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.


metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: description: Unrestricted File Upload
source: discovery: UNKNOWN
x_generator: engine: Vulnogram 0.1.0-dev