Read the docs
TI-2021-13058 Aliases CVE-2021-33684GHSA-69qv-phc7-2vh6

Out-of-bounds write in SAP NetWeaver AS ABAP and ABAP Platform

Priority LOW 26CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

SAP NetWeaver AS ABAP and ABAP Platform, versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 8.04, 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 8.04, 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.77, 7.81, 7.84, allows an attacker to send overlong content in the RFC request type thereby crashing the corresponding work process because of memory corruption vulnerability. The work process will attempt to restart itself after the crash and hence the impact on the availability is low.

Why it matters now

EPSS 0.00985 62nd percentileScored 2026-11-07
Fix Fixed SAP NetWeaver AS ABAP and ABAP Platform (SAP SE): 7.21EXT, 7.22, 7.22EXT +6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP NetWeaver AS ABAP and ABAP Platform< KRNL32NUC 7.21; before 7.21EXT; before 7.22; before 7.22EXT; < KRNL32UC 7.21; < KRNL64NUC 7.21; before 7.49; < KRNL64UC 8.04; before 7.21; before 7.53; < KERNEL 8.04; before 7.77; before 7.81; before 7.847.21EXT, 7.22, 7.22EXT, 7.49, 7.21, 7.53, 7.77, 7.81, 7.84Patch availableCNA
  • SAP NetWeaver AS ABAP and ABAP Platform VendorSAP Affected < KRNL32NUC 7.21; before 7.21EXT; before 7.22; before 7.22EXT; < KRNL32UC 7.21; < KRNL64NUC 7.21; before 7.49; < KRNL64UC 8.04; before 7.21; before 7.53; < KERNEL 8.04; before 7.77; before 7.81; before 7.84 Fixed in 7.21EXT, 7.22, 7.22EXT, 7.49, 7.21, 7.53, 7.77, 7.81, 7.84 Patch available CNA

CPE configurations NVD · 26

CPEVersionsRoleVendor
cpe:2.3:a:sap:netweaver_abap:7.21:*:*:*:*:*:*:*7.21VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:7.21ext:*:*:*:*:*:*:*7.21extVulnerableSAP
cpe:2.3:a:sap:netweaver_abap:7.22:*:*:*:*:*:*:*7.22VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:7.22ext:*:*:*:*:*:*:*7.22extVulnerableSAP
cpe:2.3:a:sap:netweaver_abap:7.49:*:*:*:*:*:*:*7.49VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:7.53:*:*:*:*:*:*:*7.53VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:7.77:*:*:*:*:*:*:*7.77VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:7.81:*:*:*:*:*:*:*7.81VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:kernel_8.04:*:*:*:*:*:*:*kernel_8.04VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:krnl32nuc_7.21:*:*:*:*:*:*:*krnl32nuc_7.21VulnerableSAP
  • cpe:2.3:a:sap:netweaver_abap:7.21:*:*:*:*:*:*:* Versions 7.21 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:7.21ext:*:*:*:*:*:*:* Versions 7.21ext Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:7.22:*:*:*:*:*:*:* Versions 7.22 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:7.22ext:*:*:*:*:*:*:* Versions 7.22ext Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:7.49:*:*:*:*:*:*:* Versions 7.49 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:7.53:*:*:*:*:*:*:* Versions 7.53 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:7.77:*:*:*:*:*:*:* Versions 7.77 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:7.81:*:*:*:*:*:*:* Versions 7.81 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:kernel_8.04:*:*:*:*:*:*:* Versions kernel_8.04 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:krnl32nuc_7.21:*:*:*:*:*:*:* Versions krnl32nuc_7.21 Vulnerable ·SAP
Show 16 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sap:netweaver_abap:krnl32uc_7.21:*:*:*:*:*:*:*krnl32uc_7.21VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:krnl64nuc_7.21:*:*:*:*:*:*:*krnl64nuc_7.21VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:krnl64uc_8.04:*:*:*:*:*:*:*krnl64uc_8.04VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:7.21:*:*:*:*:*:*:*7.21VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:7.21ext:*:*:*:*:*:*:*7.21extVulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:7.22:*:*:*:*:*:*:*7.22VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:7.22ext:*:*:*:*:*:*:*7.22extVulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:7.49:*:*:*:*:*:*:*7.49VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:7.53:*:*:*:*:*:*:*7.53VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:7.77:*:*:*:*:*:*:*7.77VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:7.81:*:*:*:*:*:*:*7.81VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:kernel_8.04:*:*:*:*:*:*:*kernel_8.04VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:krnl32nuc_7.21:*:*:*:*:*:*:*krnl32nuc_7.21VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:krnl32uc_7.21:*:*:*:*:*:*:*krnl32uc_7.21VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:krnl64nuc_7.21:*:*:*:*:*:*:*krnl64nuc_7.21VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_8.04:*:*:*:*:*:*:*krnl64uc_8.04VulnerableSAP
  • cpe:2.3:a:sap:netweaver_abap:krnl32uc_7.21:*:*:*:*:*:*:* Versions krnl32uc_7.21 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:krnl64nuc_7.21:*:*:*:*:*:*:* Versions krnl64nuc_7.21 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:krnl64uc_8.04:*:*:*:*:*:*:* Versions krnl64uc_8.04 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.21:*:*:*:*:*:*:* Versions 7.21 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.21ext:*:*:*:*:*:*:* Versions 7.21ext Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.22:*:*:*:*:*:*:* Versions 7.22 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.22ext:*:*:*:*:*:*:* Versions 7.22ext Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.49:*:*:*:*:*:*:* Versions 7.49 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.53:*:*:*:*:*:*:* Versions 7.53 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.77:*:*:*:*:*:*:* Versions 7.77 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.81:*:*:*:*:*:*:* Versions 7.81 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:kernel_8.04:*:*:*:*:*:*:* Versions kernel_8.04 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:krnl32nuc_7.21:*:*:*:*:*:*:* Versions krnl32nuc_7.21 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:krnl32uc_7.21:*:*:*:*:*:*:* Versions krnl32uc_7.21 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:krnl64nuc_7.21:*:*:*:*:*:*:* Versions krnl64nuc_7.21 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_8.04:*:*:*:*:*:*:* Versions krnl64uc_8.04 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP NetWeaver AS ABAP and ABAP Platform (SAP SE) Fixed in 7.21EXT, 7.22, 7.22EXT, 7.49, 7.21, 7.53, 7.77, 7.81, 7.84

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-33684
  2. 2026-10-03 Alias added: GHSA-69qv-phc7-2vh6

References

Advisory 1

Other 1

  • TI-2012-03697 Multiple stack-based buffer overflows in msg_server.exe in SAP NetWeaver ABAP 7.x allow… CVSS 2.0HIGH 10.0
  • TI-2021-09062 Improper authentication in SAP NetWeaver AS ABAP and ABAP Platform CVSS 3.1CRITICAL 9.8
  • TI-2021-15856 The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700… CVSS 3.1HIGH 8.8
  • TI-2022-06818 Uncontrolled resource consumption in SAP NetWeaver Application Server for ABAP and ABAP… CVSS 3.1HIGH 7.5
  • TI-2021-09085 Out-of-bounds write in SAP NetWeaver AS for ABAP CVSS 3.1HIGH 7.5
  • TI-2021-09049 Out-of-bounds read in SAP NetWeaver AS for ABAP CVSS 3.1HIGH 7.5
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences