CVE-2021-27611: sap se sap netweaver as abap Code Injection
CVSS: 8.2v3.0HighModified
Published 11-05-2021Last modified 03-08-2024
Vulnerability summary
CVE-2021-27611 is a high (CVSS 8.2) Code Injection vulnerability in sap se sap netweaver as abap. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 18% of scored vulnerabilities.
CVSS score
8.2/10
010
High · v3.0 (CVE.org)EPSS score
0.27%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 11-05-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
SAP NetWeaver AS ABAP, versions - 700, 701, 702, 730, 731, allow a high privileged attacker to inject malicious code by executing an ABAP report when the attacker has access to the local SAP system. The attacker could then get access to data, overwrite them, or execute a denial of service.
CVSS metrics
4 scores · 2 sources · 3 versionsMedium 6.7Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HSourcesSingle source
High 8.2Preferred score · CVE.org (CNA)
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HSourcesAll 2 agree
- NVDNIST8.2HighCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Medium 4.6Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
0.27%
Chance of exploitation in the next 30 days
Percentile
18%
Versus all other CVEs
30-day change
0.00 pp
From 0.27% on 21-09-2026
21-09-202621-10-2026
EPSS score0.27%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Sap1 product
- netweaver_application_server_abap700 | 701 | 702 | 730 | 731
Sap se1 product
- sap netweaver as abap< 700 | < 701 | < 702 | < 730 | < 731
2 vendors · 2 products