VYPR
← All advisories
High severity8.8NVD Advisory· Published Sep 14, 2021· Updated Jun 17, 2026

CVE-2021-38176

CVE-2021-38176

Description

Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query or inject ABAP code to gain access to Backend Database. On successful exploitation the threat actor could completely compromise confidentiality, integrity, and availability of the system.

Affected products

18
  • SAP/Landscape Transformation
    cpe:2.3:a:sap:landscape_transformation:2.0:*:*:*:*:*:*:*
  • SAP/Landscape Transformation Replication Server3 versions
    cpe:2.3:a:sap:landscape_transformation_replication_server:1.0:*:*:*:*:s\/4hana:*:*+ 2 more
    • cpe:2.3:a:sap:landscape_transformation_replication_server:1.0:*:*:*:*:s\/4hana:*:*
    • cpe:2.3:a:sap:landscape_transformation_replication_server:2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:landscape_transformation_replication_server:3.0:*:*:*:*:*:*:*
  • SAP/S\/4hana7 versions
    cpe:2.3:a:sap:s\/4hana:1511:*:*:*:*:*:*:*+ 6 more
    • cpe:2.3:a:sap:s\/4hana:1511:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:s\/4hana:1610:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:s\/4hana:1709:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:s\/4hana:1809:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:s\/4hana:1909:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:s\/4hana:2020:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:s\/4hana:2021:*:*:*:*:*:*:*
  • SAP/Test Data Migration Server
    cpe:2.3:a:sap:test_data_migration_server:4.0:*:*:*:*:*:*:*
  • SAP/NZDT function modulesllm-create
  • SAP SE/SAP Landscape Transformationv5
    Range: < 2.0
  • SAP SE/SAP LT Replication Serverv5
    Range: < 2.0
  • SAP SE/SAP LTRS for S/4HANAv5
    Range: < 1.0
  • SAP SE/SAP S/4HANAv5
    Range: < 1511
  • SAP SE/SAP Test Data Migration Serverv5
    Range: < 4.0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.