VYPR
← All advisories
Critical severity9.9CISA KEVNVD Advisory· Published Sep 14, 2021· Updated Jun 17, 2026

CVE-2021-38163

CVE-2021-38163

Description

SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.

Affected products

7
  • SAP/Netweaver5 versions
    cpe:2.3:a:sap:netweaver:7.30:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:sap:netweaver:7.30:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver:7.31:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver:7.40:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver:7.50:*:*:*:*:*:*:*
    • (no CPE)range: 7.30, 7.31, 7.40, 7.50
  • SAP/Visual Composerllm-fuzzy
    Range: 7.0 RT
  • SAP SE/SAP NetWeaver (Visual Composer 7.0 RT)v5
    Range: 7.30

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.