CVE-2021-38163
SAP NetWeaver: Unrestricted File Upload
As of , CVE-2021-38163 in SAP NetWeaver is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch soon.
- Exploited
- Yes: CISA listed it on 9 June 2022
- US federal deadline
- 30 June 202221 days after CISA listed it. US federal civilian agencies must fix it by then.
- Used in ransomware campaigns
- Not known to CISA
- EPSS score
- 0.37Higher than 98% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
- EPSS when listed
- 0.01 on 9 June 2022EPSS on the day CISA listed it.
- Public exploit
- None foundNeither Metasploit nor Exploit-DB lists one.
- Fix
- No vendor link in CISA's entry
What CISA says to do
Apply updates per vendor instructions.
CISA's required action
What the flaw is
SAP NetWeaver contains a vulnerability that allows unrestricted file upload.
CISA's description
SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.
The CVE record's description, from sap
- CVE published
- 14 September 2021
- Assigned by
- sap
- CVSS
- 9.9 Critical (CVSS 3.1, from the CNA)
- CWE-22
- Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CWE-23
- Relative Path Traversal
- CISA SSVC, exploitation
- active
- CISA SSVC, automatable
- no
- CISA SSVC, technical impact
- total
Timeline
- The CVE record was published.
- CISA added it to its list of exploited vulnerabilities.
- The US federal deadline to fix it.
NetWeaver: other exploited entries
| Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|
| CVE-2020-6287Missing Authentication for Critical Function | SAP NetWeaver | Patch this weekMetasploit module; EPSS 0.95 | 0.95 | ||
| CVE-2025-31324Unrestricted File Upload | SAP NetWeaver | Patch this weekRansomware use; EPSS 0.99 | 0.99 | ||
| CVE-2017-12637Directory Traversal | SAP NetWeaver | Patch this weekEPSS 0.95 | 0.95 | ||
| CVE-2016-2386SQL Injection | SAP NetWeaver | Patch this weekEPSS 0.72 | 0.72 | ||
| CVE-2016-2388Information Disclosure | SAP NetWeaver | Patch this weekEPSS 0.52 | 0.52 | ||
| CVE-2025-42999Deserialization | SAP NetWeaver | Patch this weekRansomware use | 0.14 | ||
| CVE-2016-3976Directory Traversal | SAP NetWeaver | Patch soon | 0.47 | ||
| CVE-2010-5326Remote Code Execution | SAP NetWeaver | Patch soon | 0.18 | ||
| CVE-2016-9563XML External Entity (XXE) | SAP NetWeaver | Patch soon | 0.24 |
Read further
- CVE recordcve.org
- NVD entrynvd.nist.gov
- CISA's catalogcisa.gov
- EPSS for this CVEapi.first.org