CVE-2021-38163

SAP SE SAP NetWeaver (Visual Composer 7.0 RT)

Published 14 Sept 2021 · updated 17 Jun 2026 · Analyzed

8.8 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 9 Jun 2022, with a remediation deadline of 30 Jun 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.

References

launchpad.support.sap.com/#/notes/3084487 · Permissions Required
wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 · Broken Link, Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38163 · US Government Resource