Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-33701

DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 710, 2011_1_752, 2020, SAPSCORE 125, S4CORE 102, 102, 103, 104, 105, allows an attacker with access to highly privileged account to execute manipulated query in NDZT tool to gain access to Superuser account, leading to SQL Injection vulnerability, that highly impacts systems Confidentiality, Integrity and Availability.

Published

2021-09-15T19:15:09.697

Last Modified

2024-11-21T06:09:24.077

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.1 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

8.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-89
  • Type: Secondary
    CWE-89
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application sap dmis 710 Yes
Application sap dmis 2011_1_620 Yes
Application sap dmis 2011_1_640 Yes
Application sap dmis 2011_1_700 Yes
Application sap dmis 2011_1_710 Yes
Application sap dmis 2011_1_730 Yes
Application sap dmis 2011_1_731 Yes
Application sap dmis 2011_1_752 Yes
Application sap dmis 2020125 Yes
Application sap s4core 102 Yes
Application sap s4core 103 Yes
Application sap s4core 104 Yes
Application sap s4core 105 Yes
Application sap sapscore 125 Yes
References