CVE-2021-33678

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-07-14 · updated 2026-06-17
Weakness: CWE-95

Description

A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75B, 75C, 75D, 75E, 75F, allows a high privileged attacker to inject code that can be executed by the application. An attacker could thereby delete some critical information and could make the SAP system completely unavailable.

Affected products

SAP_SE SAP NetWeaver Application Server for ABAP and ABAP Platform: 75a, 75b, 75c, 75d, 75e, 75f (+11)

References

http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html
http://seclists.org/fulldisclosure/2022/May/42
https://launchpad.support.sap.com/#/notes/3048657
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506
http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html
http://seclists.org/fulldisclosure/2022/May/42
https://launchpad.support.sap.com/#/notes/3048657
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506

Get alerted when CVE-2021-33678 or the next vulnerability affects your stack