by Kastro
Paper/Archive/CVE-2021-44231

CVE-2021-44231

SAP SE SAP ABAP Server & ABAP Platform (Translation Tools) — Internally used text extraction reports allow an attacker to inject code that can be executed by the application.

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 72.3.723 × 2014.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Internally used text extraction reports allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.

Affected

ProductAffectedFixed inSource
SAP ABAP Server & ABAP Platform (Translation Tools)< 701–CNA
SAP ABAP Server & ABAP Platform (Translation Tools)< 740–CNA
SAP ABAP Server & ABAP Platform (Translation Tools)< 750–CNA
SAP ABAP Server & ABAP Platform (Translation Tools)< 751–CNA
SAP ABAP Server & ABAP Platform (Translation Tools)< 752–CNA
SAP ABAP Server & ABAP Platform (Translation Tools)< 753–CNA
SAP ABAP Server & ABAP Platform (Translation Tools)< 754–CNA
SAP ABAP Server & ABAP Platform (Translation Tools)< 755–CNA
SAP ABAP Server & ABAP Platform (Translation Tools)< 756–CNA
SAP ABAP Server & ABAP Platform (Translation Tools)< 804–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refwiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021reflaunchpad.support.sap.com/#/notes/3119365