{"id":"CVE-2021-38163","published":"2021-09-14T12:15:10Z","modified":"2026-06-17T04:01:38Z","title":"SAP NetWeaver Unrestricted File Upload Vulnerability","vendor":"SAP","product":"NetWeaver","tier":"core","eol":null,"description":{"text":"SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.","provenance":"source","from":"NVD"},"summary":{"text":"SAP NetWeaver's Visual Composer 7.0 RT component (versions 7.30, 7.31, 7.40 and 7.50) contains an unrestricted file upload flaw. An attacker who is authenticated as a non-administrative user and has network access can upload a malicious file without user interaction and trigger its processing, which can run operating system commands with the privileges of the Java Server process.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:54:17Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.36898,"percentile":0.98507,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-06-09","dueDate":"2022-06-30","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-38163","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-06-09","exploitedFirstSeen":"2022-06-09","ransomware":false,"evidence":[{"url":"https://onapsis.com/blog/three-actively-exploited-sap-vulnerabilities-identified-onapsis-research-labs","date":"2022-06-09"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-06-09"},{"url":"https://www.csoonline.com/article/2092336/sap-users-are-at-high-risk-as-hackers-exploit-application-vulnerabilities.html","date":"2024-04-17"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"},{"id":"CWE-23","name":"Relative Path Traversal"}],"references":[{"url":"https://launchpad.support.sap.com/#/notes/3084487","tags":["Permissions Required"]},{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405","tags":["Broken Link","Vendor Advisory"]},{"url":"https://launchpad.support.sap.com/#/notes/3084487","tags":["Permissions Required"]},{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405","tags":["Broken Link","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38163","tags":["US Government Resource"]}],"techniques":[{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Requires authenticated low-privilege account access","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"an attacker authenticated as a non-administrative user can upload","start":95,"end":160}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Arbitrary OS command execution on server","mappingType":"primary_impact","evidence":[{"from":"description","quote":"capable of running operating system commands with the privilege of the Java Server process","start":230,"end":320}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-24633","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-24633","exploited":true,"exploitedSince":"2022-06-09","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2022-09-10","earliestUrl":"https://github.com/core1impact/CVE-2021-38163","repos":[{"name":"core1impact/CVE-2021-38163","url":"https://github.com/core1impact/CVE-2021-38163","stars":4,"created":"2022-09-10"},{"name":"purpleteam-ru/CVE-2021-38163","url":"https://github.com/purpleteam-ru/CVE-2021-38163","stars":0,"created":"2025-04-04"}]},"first":{"date":"2022-09-10","source":"PoC-in-GitHub","url":"https://github.com/core1impact/CVE-2021-38163"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1078"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2021-09-14","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-38163","provenance":"source"},{"date":"2022-06-09","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://onapsis.com/blog/three-actively-exploited-sap-vulnerabilities-identified-onapsis-research-labs","provenance":"source"},{"date":"2022-06-09","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-06-09","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-24633","provenance":"source"},{"date":"2022-09-10","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/core1impact/CVE-2021-38163","provenance":"source"}],"speed":{"daysToPublicExploit":361,"firstExploitFrom":"PoC-in-GitHub","daysToKev":268},"priority":{"score":68.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1605 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.7,"detail":"percentile 0.9851"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-sap-netweaver-cwe-22"}}