NVD Vulnerability Detail

CVE-2021-33701

Summary	DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 710, 2011_1_752, 2020, SAPSCORE 125, S4CORE 102, 102, 103, 104, 105, allows an attacker with access to highly privileged account to execute manipulated query in NDZT tool to gain access to Superuser account, leading to SQL Injection vulnerability, that highly impacts systems Confidentiality, Integrity and Availability.
Publication Date	Sept. 16, 2021, 4:15 a.m.
Registration Date	Sept. 16, 2021, 10 a.m.
Last Update	Nov. 21, 2024, 3:09 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://packetstormsecurity.com/files/165303/SAP-Netweaver-IUUC_RECON_RC_COUNT_TABLE_BIG-SQL-Injection.html	Exploit Third Party Advisory VDB Entry
2	http://packetstormsecurity.com/files/165303/SAP-Netweaver-IUUC_RECON_RC_COUNT_TABLE_BIG-SQL-Injection.html	Exploit Third Party Advisory VDB Entry
3	http://packetstormsecurity.com/files/165304/SAP-Netweaver-IUUC_RECON_RC_COUNT_TABLE_BIG-ABAP-Code-Injection.html	Exploit Third Party Advisory VDB Entry
4	http://packetstormsecurity.com/files/165304/SAP-Netweaver-IUUC_RECON_RC_COUNT_TABLE_BIG-ABAP-Code-Injection.html	Exploit Third Party Advisory VDB Entry
5	http://seclists.org/fulldisclosure/2021/Dec/35	Exploit Mailing List Third Party Advisory
6	http://seclists.org/fulldisclosure/2021/Dec/35	Exploit Mailing List Third Party Advisory
7	http://seclists.org/fulldisclosure/2021/Dec/36	Exploit Mailing List Third Party Advisory
8	http://seclists.org/fulldisclosure/2021/Dec/36	Exploit Mailing List Third Party Advisory
9	https://launchpad.support.sap.com/#/notes/3078312	Permissions Required VDB Entry Vendor Advisory
10	https://launchpad.support.sap.com/#/notes/3078312	Permissions Required VDB Entry Vendor Advisory
11	https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806	Vendor Advisory
12	https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806	Vendor Advisory

Common Vulnerabilities List

JVN Vulnerability Information

DMIS Mobile Plug-In および SAP S/4HANA における SQL インジェクションの脆弱性

Title	DMIS Mobile Plug-In および SAP S/4HANA における SQL インジェクションの脆弱性
Summary	DMIS Mobile Plug-In および SAP S/4HANA には、 SQL インジェクションの脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Dec. 14, 2021, midnight
Registration Date	Sept. 5, 2022, 11:04 a.m.
Last Update	Sept. 5, 2022, 11:04 a.m.

Affected System

SAP

DMIS

S4CORE 102

S4CORE 103

S4CORE 104

S4CORE 105

SAPSCORE 125

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-33701	https://www.cve.org/CVERecord?id=CVE-2021-33701
National Vulnerability Database (NVD)
2	CVE-2021-33701	https://nvd.nist.gov/vuln/detail/CVE-2021-33701

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-89	https://jvndb.jvn.jp/ja/cwe/CWE-89.html

ベンダー情報

No	Name	URL
SAP
1	トップページ	https://www.sap.com/japan/index.html

その他

No	Name	URL
関連文書
1	SEC Consult SA-20211214-0 :: Remote ADBC SQL Injection in SAP Netweaver IUUC_RECON_RC_COUNT_TABLE_BIG	https://seclists.org/fulldisclosure/2021/Dec/35
2	SEC Consult SA-20211214-1 :: Remote ABAP Code Injection in SAP Netweaver IUUC_RECON_RC_COUNT_TABLE_BIG	https://seclists.org/fulldisclosure/2021/Dec/36

Change Log

No	Changed Details	Date of change
1	[2022年09月05日] 掲載	Sept. 5, 2022, 11:04 a.m.