github - ghsa-4qx6-hc3f-6gj9

GHSA-4QX6-HC3F-6GJ9

Vulnerability from github – Published: 2022-05-24 19:14 – Updated: 2022-07-13 00:01

Details

Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query to gain access to Backend Database. On successful exploitation the threat actor could completely compromise confidentiality, integrity, and availability of the system.

Severity ?

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-38176"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-09-14T12:15:00Z",
    "severity": "HIGH"
  },
  "details": "Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query to gain access to Backend Database. On successful exploitation the threat actor could completely compromise confidentiality, integrity, and availability of the system.",
  "id": "GHSA-4qx6-hc3f-6gj9",
  "modified": "2022-07-13T00:01:34Z",
  "published": "2022-05-24T19:14:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38176"
    },
    {
      "type": "WEB",
      "url": "https://launchpad.support.sap.com/#/notes/3089831"
    },
    {
      "type": "WEB",
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2021-38176 (GCVE-0-2021-38176)

Vulnerability from cvelistv5 – Published: 2021-09-14 11:19 – Updated: 2024-08-04 01:37

Summary

Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query or inject ABAP code to gain access to Backend Database. On successful exploitation the threat actor could completely compromise confidentiality, integrity, and availability of the system.

Severity ?

9.9 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE

Improper Input Sanitization

Assigner

sap

References

URL

Tags

	https://wiki.scn.sap.com/wiki/pages/viewpage.acti…	x_refsource_MISC
	https://launchpad.support.sap.com/#/notes/3089831	x_refsource_MISC

Impacted products

Vendor

Product

Version

SAP SE

SAP S/4HANA

Affected: < 1511
Affected: < 1610
Affected: < 1709
Affected: < 1809
Affected: < 1909
Affected: < 2020
Affected: < 2021

SAP SE	SAP LT Replication Server	Affected: < 2.0 Affected: < 3.0
SAP SE	SAP LTRS for S/4HANA	Affected: < 1.0
SAP SE	SAP Test Data Migration Server	Affected: < 4.0
SAP SE	SAP Landscape Transformation	Affected: < 2.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:37:16.300Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://launchpad.support.sap.com/#/notes/3089831"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SAP S/4HANA",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1511"
            },
            {
              "status": "affected",
              "version": "\u003c 1610"
            },
            {
              "status": "affected",
              "version": "\u003c 1709"
            },
            {
              "status": "affected",
              "version": "\u003c 1809"
            },
            {
              "status": "affected",
              "version": "\u003c 1909"
            },
            {
              "status": "affected",
              "version": "\u003c 2020"
            },
            {
              "status": "affected",
              "version": "\u003c 2021"
            }
          ]
        },
        {
          "product": "SAP LT Replication Server",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0"
            },
            {
              "status": "affected",
              "version": "\u003c 3.0"
            }
          ]
        },
        {
          "product": "SAP LTRS for S/4HANA",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0"
            }
          ]
        },
        {
          "product": "SAP Test Data Migration Server",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.0"
            }
          ]
        },
        {
          "product": "SAP Landscape Transformation",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query or inject ABAP code to gain access to Backend Database. On successful exploitation the threat actor could completely compromise confidentiality, integrity, and availability of the system."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Input Sanitization",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-11-30T17:49:36",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://launchpad.support.sap.com/#/notes/3089831"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@sap.com",
          "ID": "CVE-2021-38176",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SAP S/4HANA",
                      "version": {
                        "version_data": [
                          {
                            "version_name": "\u003c",
                            "version_value": "1511"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "1610"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "1709"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "1809"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "1909"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "2020"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "2021"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SAP LT Replication Server",
                      "version": {
                        "version_data": [
                          {
                            "version_name": "\u003c",
                            "version_value": "2.0"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "3.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SAP LTRS for S/4HANA",
                      "version": {
                        "version_data": [
                          {
                            "version_name": "\u003c",
                            "version_value": "1.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SAP Test Data Migration Server",
                      "version": {
                        "version_data": [
                          {
                            "version_name": "\u003c",
                            "version_value": "4.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SAP Landscape Transformation",
                      "version": {
                        "version_data": [
                          {
                            "version_name": "\u003c",
                            "version_value": "2.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SAP SE"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query or inject ABAP code to gain access to Backend Database. On successful exploitation the threat actor could completely compromise confidentiality, integrity, and availability of the system."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "9.9",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Input Sanitization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405",
              "refsource": "MISC",
              "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405"
            },
            {
              "name": "https://launchpad.support.sap.com/#/notes/3089831",
              "refsource": "MISC",
              "url": "https://launchpad.support.sap.com/#/notes/3089831"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2021-38176",
    "datePublished": "2021-09-14T11:19:07",
    "dateReserved": "2021-08-07T00:00:00",
    "dateUpdated": "2024-08-04T01:37:16.300Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-4QX6-HC3F-6GJ9

CVE-2021-38176 (GCVE-0-2021-38176)

Tags

Sightings

Nomenclature