Medium severity6.5NVD Advisory· Published Jul 14, 2021· Updated Jun 17, 2026
CVE-2021-33678
CVE-2021-33678
Description
A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75B, 75C, 75D, 75E, 75F, allows a high privileged attacker to inject code that can be executed by the application. An attacker could thereby delete some critical information and could make the SAP system completely unavailable.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
19cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:*:*:*:*+ 16 more
- cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:701:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:702:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:710:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:711:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:730:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:731:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:751:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:752:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:75a:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:75b:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:75c:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:75d:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:75e:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_application_server_abap:75f:*:*:*:*:*:*:*
- Range: 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75B, 75C, 75D, 75E, 75F
- SAP SE/SAP NetWeaver AS ABAP (Reconciliation Framework)v5Range: < 700
Patches
Vulnerability mechanics
References
4- packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.htmlnvdExploitThird Party AdvisoryVDB Entry
- seclists.org/fulldisclosure/2022/May/42nvdExploitMailing ListThird Party Advisory
- wiki.scn.sap.com/wiki/pages/viewpage.actionnvdVendor Advisory
- launchpad.support.sap.comnvdPermissions Required
News mentions
0No linked articles in our index yet.