SAP · NetWeaver
CVE-2021-38163
SAP NetWeaver Unrestricted File Upload Vulnerability
Cos'è
SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.
CISA: SAP NetWeaver contains a vulnerability that allows unrestricted file upload.
Cosa fare
Apply updates per vendor instructions.
Scadenza per le agenzie federali USA: 30 giugno 2022
Altre falle sfruttate di SAP
| Aggiunto | Vulnerabilità | Prodotto | Gravità | Probabilità di attacco |
|---|---|---|---|---|
| 15 mag 2025 | Deserialization | NetWeaver | Critica 9,1 | 13% |
| 29 apr 2025 | Unrestricted File Upload | NetWeaver | Critica 10,0 | 99,5% |
| 19 mar 2025 | Directory Traversal | NetWeaver | Alta 7,5 | 95% |
| 9 giu 2022 | SQL Injection | NetWeaver | Critica 9,8 | 72% |
| 9 giu 2022 | Information Disclosure | NetWeaver | Media 5,3 | 52% |
| 3 nov 2021 | Remote Code Execution | NetWeaver | Critica 10,0 | 18% |
| 3 nov 2021 | Directory Traversal | NetWeaver | Alta 7,5 | 47% |
| 3 nov 2021 | XML External Entity (XXE) | NetWeaver | Media 6,5 | 24% |
Fonti: Known Exploited Vulnerabilities (CISA, pubblico dominio), CVE records (cve.org) e EPSS (FIRST). La probabilità di attacco è la stima EPSS che qualcuno provi a sfruttare la falla nei prossimi 30 giorni.