SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.
\"}], \"value\": \"SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.\"}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 9.9, \"baseSeverity\": \"CRITICAL\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"scope\": \"CHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\", \"version\": \"3.1\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"description\": \"Unrestricted File Upload\", \"lang\": \"en\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2023-07-10T17:53:49.199Z\", \"orgId\": \"e4686d1a-f260-4930-ac4c-2f5c992778dd\", \"shortName\": \"sap\"}, \"references\": [{\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://launchpad.support.sap.com/#/notes/3084487\"}], \"source\": {\"discovery\": \"UNKNOWN\"}, \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"x_legacyV4Record\": {\"CVE_data_meta\": {\"ASSIGNER\": \"cna@sap.com\", \"ID\": \"CVE-2021-38163\", \"STATE\": \"PUBLIC\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"product_name\": \"SAP NetWeaver (Visual Composer 7.0 RT)\", \"version\": {\"version_data\": [{\"version_name\": \"<\", \"version_value\": \"7.30\"}, {\"version_name\": \"<\", \"version_value\": \"7.31\"}, {\"version_name\": \"<\", \"version_value\": \"7.40\"}, {\"version_name\": \"<\", \"version_value\": \"7.50\"}]}}]}, \"vendor_name\": \"SAP SE\"}]}}, \"data_format\": \"MITRE\", \"data_type\": \"CVE\", \"data_version\": \"4.0\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.\"}]}, \"impact\": {\"cvss\": {\"baseScore\": \"9.9\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\", \"version\": \"3.0\"}}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"Unrestricted File Upload\"}]}]}, \"references\": {\"reference_data\": [{\"name\": \"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405\", \"refsource\": \"MISC\", \"url\": \"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405\"}, {\"name\": \"https://launchpad.support.sap.com/#/notes/3084487\", \"refsource\": \"MISC\", \"url\": \"https://launchpad.support.sap.com/#/notes/3084487\"}]}}}}, \"cveMetadata\": {\"assignerOrgId\": \"e4686d1a-f260-4930-ac4c-2f5c992778dd\", \"assignerShortName\": \"sap\", \"cveId\": \"CVE-2021-38163\", \"datePublished\": \"2021-09-14T11:21:36.000Z\", \"dateReserved\": \"2021-08-07T00:00:00.000Z\", \"dateUpdated\": \"2025-10-21T23:25:33.764Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.1\"}"},{"alert":0,"cve":"CVE-2021-38163","id":7106,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.36898, \"percentile\": 0.98514}"},{"alert":0,"cve":"CVE-2021-38163","id":4883,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.36898, \"percentile\": 0.98511}"},{"alert":0,"cve":"CVE-2021-38163","id":2665,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.36898, \"percentile\": 0.9851}"},{"alert":1,"cve":"CVE-2021-38163","id":991,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2021-38163\", \"cwes\": [\"CWE-23\"], \"dateAdded\": \"2022-06-09\", \"dueDate\": \"2022-06-30\", \"forensicTriage\": \"No\", \"knownRansomwareCampaignUse\": \"Unknown\", \"notes\": \"https://nvd.nist.gov/vuln/detail/CVE-2021-38163\", \"product\": \"NetWeaver\", \"requiredAction\": \"Apply updates per vendor instructions.\", \"shortDescription\": \"SAP NetWeaver contains a vulnerability that allows unrestricted file upload.\", \"vendorProject\": \"SAP\", \"vulnerabilityName\": \"SAP NetWeaver Unrestricted File Upload Vulnerability\"}"}],"record":{"affected":[{"defaultStatus":"unaffected","product":"SAP NetWeaver (Visual Composer 7.0 RT)","vendor":"SAP SE","versions":[{"status":"affected","version":"7.30"},{"status":"affected","version":"7.31"},{"status":"affected","version":"7.40"},{"status":"affected","version":"7.50"}]}],"cna":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-04T01:37:16.194Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://launchpad.support.sap.com/#/notes/3084487"}],"title":"CVE Program Container"},{"metrics":[{"other":{"content":{"id":"CVE-2021-38163","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2025-01-29T20:19:43.828648Z","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2022-06-09","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38163"},"type":"kev"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2025-10-21T23:25:33.764Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38163"}],"timeline":[{"lang":"en","time":"2022-06-09T00:00:00.000Z","value":"CVE-2021-38163 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"SAP NetWeaver (Visual Composer 7.0 RT)","vendor":"SAP SE","versions":[{"status":"affected","version":"7.30"},{"status":"affected","version":"7.31"},{"status":"affected","version":"7.40"},{"status":"affected","version":"7.50"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.
"}],"value":"SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"description":"Unrestricted File Upload","lang":"en"}]}],"providerMetadata":{"dateUpdated":"2023-07-10T17:53:49.199Z","orgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","shortName":"sap"},"references":[{"tags":["x_refsource_MISC"],"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405"},{"tags":["x_refsource_MISC"],"url":"https://launchpad.support.sap.com/#/notes/3084487"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cna@sap.com","ID":"CVE-2021-38163","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"SAP NetWeaver (Visual Composer 7.0 RT)","version":{"version_data":[{"version_name":"<","version_value":"7.30"},{"version_name":"<","version_value":"7.31"},{"version_name":"<","version_value":"7.40"},{"version_name":"<","version_value":"7.50"}]}}]},"vendor_name":"SAP SE"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable."}]},"impact":{"cvss":{"baseScore":"9.9","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.0"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Unrestricted File Upload"}]}]},"references":{"reference_data":[{"name":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405","refsource":"MISC","url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405"},{"name":"https://launchpad.support.sap.com/#/notes/3084487","refsource":"MISC","url":"https://launchpad.support.sap.com/#/notes/3084487"}]}}}},"cveMetadata":{"assignerOrgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","assignerShortName":"sap","cveId":"CVE-2021-38163","datePublished":"2021-09-14T11:21:36.000Z","dateReserved":"2021-08-07T00:00:00.000Z","dateUpdated":"2025-10-21T23:25:33.764Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"cna_checked":1794349204,"cve":"CVE-2021-38163","description":"SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.","epss":{"date":"2026-11-12","epss":0.36898,"percentile":0.98531},"epss_checked":1794522003,"first_seen":1793665375,"kev":{"cveID":"CVE-2021-38163","cwes":["CWE-23"],"dateAdded":"2022-06-09","dueDate":"2022-06-30","forensicTriage":"No","knownRansomwareCampaignUse":"Unknown","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-38163","product":"NetWeaver","requiredAction":"Apply updates per vendor instructions.","shortDescription":"SAP NetWeaver contains a vulnerability that allows unrestricted file upload.","vendorProject":"SAP","vulnerabilityName":"SAP NetWeaver Unrestricted File Upload Vulnerability"},"kev_checked":1794522003,"products":"SAP SE SAP NetWeaver (Visual Composer 7.0 RT)","references":["https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405","https://launchpad.support.sap.com/#/notes/3084487","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38163"],"score":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","provider":"sap","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"SAP NetWeaver Unrestricted File Upload Vulnerability","updated_at":1794500401,"workarounds":""},"sources":[]}