01 Record

CVE-2021-33701

DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 710, 2011_1_752, 2020, SAPSCORE 125, S4CORE 102, 102, 103, 104, 105,

CriticalPUBLISHEDCNA: sap

CNA base score9.1 CVSS v3.xCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

View raw JSON

02 Description

DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 710, 2011_1_752, 2020, SAPSCORE 125, S4CORE 102, 102, 103, 104, 105,

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 2.08% probability of exploitation activity in the next 30 days.
EPSS percentile: Ranks above 79.8% of scored records. A rank, not a probability.
NVD base score: 9.1 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2021-09-15 18:01Z4 YR AGO

Last updated

2024-08-03 23:58Z2 YR AGO

Reserved

2021-05-28

Assigning CNA

sap

Record state

PUBLISHED

Severity

Critical (CVSS 9.1)

CNA CVSS vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Base

Data version

5.1

Document digest

38faccb3682d6ab39e50c642834d939fd6d2b49348b0f684b6f637f797f897a7

05 Affected products

VendorProductVersionsPlatforms

SAP SEDMIS Mobile Plug-In< DMIS 2011_1_620, < 2011_1_640, < 2011_1_700, < 2011_1_710, < 2011_1_730, < 710, < 2011_1_731, < 2011_1_752, < 2020—

SAP SESAP S/4HANA< SAPSCORE 125, < S4CORE 102, < 102, < 103, < 104, < 105—

06 References

wiki.scn.sap.comhttps://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806x_refsource_MISC
launchpad.support.sap.comhttps://launchpad.support.sap.com/#/notes/3078312x_refsource_MISC
seclists.org20211214 SEC Consult SA-20211214-1 :: Remote ABAP Code Injection in SAP Netweaver IUUC_RECON_RC_COUNT_TABLE_BIGhttp://seclists.org/fulldisclosure/2021/Dec/36mailing-listx_refsource_FULLDISC
seclists.org20211214 SEC Consult SA-20211214-0 :: Remote ADBC SQL Injection in SAP Netweaver IUUC_RECON_RC_COUNT_TABLE_BIGhttp://seclists.org/fulldisclosure/2021/Dec/35mailing-listx_refsource_FULLDISC
packetstormsecurity.comhttp://packetstormsecurity.com/files/165303/SAP-Netweaver-IUUC_RECON_RC_COUNT_TABLE_BIG-SQL-Injection.htmlx_refsource_MISC
packetstormsecurity.comhttp://packetstormsecurity.com/files/165304/SAP-Netweaver-IUUC_RECON_RC_COUNT_TABLE_BIG-ABAP-Code-Injection.htmlx_refsource_MISC

01 Record index

CVE-2021-33701

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2021-33701

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References