CVE-2021-42067

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-01-14 · updated 2026-06-17

Description

In SAP NetWeaver AS for ABAP and ABAP Platform - versions 701, 702, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 786, an attacker authenticated as a regular user can use the S/4 Hana dashboard to reveal systems and services which they would not normally be allowed to see. No information alteration or denial of service is possible.

Affected products

SAP SE SAP NetWeaver AS for ABAP (RFC Gateway): 701, 702, 711, 730, 731, 740 (+8)
SAP_SE SAP NetWeaver Application Server for ABAP and ABAP Platform: 701, 702, 711, 730, 731, 740 (+8)

References

https://launchpad.support.sap.com/#/notes/3112710
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=596902035
https://launchpad.support.sap.com/#/notes/3112710
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=596902035

Get alerted when CVE-2021-42067 or the next vulnerability affects your stack