CVE-2021-33701: SQL Injection
DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 20111620, 20111640, 20111700, 20111710, 20111730, 710, 20111731, 710, 20111752, 2020, SAPSCORE 125, S4CORE 102, 102, 103, 104, 105, allows an attacker with access to highly privileged account to execute manipulated query in NDZT tool to gain access to Superuser account, leading to SQL Injection vulnerability, that highly impacts systems Confidentiality, Integrity and Availability.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-33701?
CVE-2021-33701 is a critical vulnerability in DMIS Mobile Plug-In or SAP S/4HANA versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 710, 2011_1_752, 2020, SAPSCORE 125, S4CORE 102, 102, 103, 104, 105, that allows an attacker with access to a highly privileged account to execute manipulated queries in the NDZT tool.
What is the severity of CVE-2021-33701?
CVE-2021-33701 has a severity rating of 9.1 (critical).
Which software versions are affected by CVE-2021-33701?
CVE-2021-33701 affects DMIS Mobile Plug-In and SAP S/4HANA versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 710, 2011_1_752, 2020, SAPSCORE 125, S4CORE 102, 102, 103, 104, 105.
How does CVE-2021-33701 exploit work?
CVE-2021-33701 allows an attacker with access to a highly privileged account to execute manipulated queries in the NDZT tool.
Are there any references for CVE-2021-33701?
Yes, you can find more information about CVE-2021-33701 at the following references: [Reference 1](http://packetstormsecurity.com/files/165303/SAP-Netweaver-IUUC_RECON_RC_COUNT_TABLE_BIG-SQL-Injection.html), [Reference 2](http://packetstormsecurity.com/files/165304/SAP-Netweaver-IUUC_RECON_RC_COUNT_TABLE_BIG-ABAP-Code-Injection.html), [Reference 3](http://seclists.org/fulldisclosure/2021/Dec/35).