Read the docs
TI-2021-13075 Aliases CVE-2021-33701GHSA-ch32-3mmp-49c5

SQL injection in SAP DMIS Mobile Plug-In

Priority MEDIUM 43CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 710, 2011_1_752, 2020, SAPSCORE 125, S4CORE 102, 102, 103, 104, 105, allows an attacker with access to highly privileged account to execute manipulated query in NDZT tool to gain access to Superuser account, leading to SQL Injection vulnerability, that highly impacts systems Confidentiality, Integrity and Availability.

Why it matters now

EPSS 0.02077 81st percentileScored 2026-11-07
Public exploit Yes 4 exploit referencesTagged by NVD
Fix Fixed DMIS Mobile Plug-In (SAP SE): 2011_1_640, 2011_1_700, 2011_1_710 +5SAP S/4HANA (SAP SE): 102, 103, 104 +1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPDMIS Mobile Plug-In< DMIS 2011_1_620; before 2011_1_640; before 2011_1_700; before 2011_1_710; before 2011_1_730; before 710; before 2011_1_731; before 2011_1_752; before 20202011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 2011_1_752, 2020Patch availableCNA
SAPSAP S/4HANA< SAPSCORE 125; < S4CORE 102; before 102; before 103; before 104; before 105102, 103, 104, 105Patch availableCNA
  • DMIS Mobile Plug-In VendorSAP Affected < DMIS 2011_1_620; before 2011_1_640; before 2011_1_700; before 2011_1_710; before 2011_1_730; before 710; before 2011_1_731; before 2011_1_752; before 2020 Fixed in 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 2011_1_752, 2020 Patch available CNA
  • SAP S/4HANA VendorSAP Affected < SAPSCORE 125; < S4CORE 102; before 102; before 103; before 104; before 105 Fixed in 102, 103, 104, 105 Patch available CNA

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:sap:dmis:710:*:*:*:*:*:*:*710VulnerableSAP
cpe:2.3:a:sap:dmis:2011_1_620:*:*:*:*:*:*:*2011_1_620VulnerableSAP
cpe:2.3:a:sap:dmis:2011_1_640:*:*:*:*:*:*:*2011_1_640VulnerableSAP
cpe:2.3:a:sap:dmis:2011_1_700:*:*:*:*:*:*:*2011_1_700VulnerableSAP
cpe:2.3:a:sap:dmis:2011_1_710:*:*:*:*:*:*:*2011_1_710VulnerableSAP
cpe:2.3:a:sap:dmis:2011_1_730:*:*:*:*:*:*:*2011_1_730VulnerableSAP
cpe:2.3:a:sap:dmis:2011_1_731:*:*:*:*:*:*:*2011_1_731VulnerableSAP
cpe:2.3:a:sap:dmis:2011_1_752:*:*:*:*:*:*:*2011_1_752VulnerableSAP
cpe:2.3:a:sap:dmis:2020125:*:*:*:*:*:*:*2020125VulnerableSAP
cpe:2.3:a:sap:s4core:102:*:*:*:*:*:*:*102VulnerableSAP
  • cpe:2.3:a:sap:dmis:710:*:*:*:*:*:*:* Versions 710 Vulnerable ·SAP
  • cpe:2.3:a:sap:dmis:2011_1_620:*:*:*:*:*:*:* Versions 2011_1_620 Vulnerable ·SAP
  • cpe:2.3:a:sap:dmis:2011_1_640:*:*:*:*:*:*:* Versions 2011_1_640 Vulnerable ·SAP
  • cpe:2.3:a:sap:dmis:2011_1_700:*:*:*:*:*:*:* Versions 2011_1_700 Vulnerable ·SAP
  • cpe:2.3:a:sap:dmis:2011_1_710:*:*:*:*:*:*:* Versions 2011_1_710 Vulnerable ·SAP
  • cpe:2.3:a:sap:dmis:2011_1_730:*:*:*:*:*:*:* Versions 2011_1_730 Vulnerable ·SAP
  • cpe:2.3:a:sap:dmis:2011_1_731:*:*:*:*:*:*:* Versions 2011_1_731 Vulnerable ·SAP
  • cpe:2.3:a:sap:dmis:2011_1_752:*:*:*:*:*:*:* Versions 2011_1_752 Vulnerable ·SAP
  • cpe:2.3:a:sap:dmis:2020125:*:*:*:*:*:*:* Versions 2020125 Vulnerable ·SAP
  • cpe:2.3:a:sap:s4core:102:*:*:*:*:*:*:* Versions 102 Vulnerable ·SAP
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sap:s4core:103:*:*:*:*:*:*:*103VulnerableSAP
cpe:2.3:a:sap:s4core:104:*:*:*:*:*:*:*104VulnerableSAP
cpe:2.3:a:sap:s4core:105:*:*:*:*:*:*:*105VulnerableSAP
cpe:2.3:a:sap:sapscore:125:*:*:*:*:*:*:*125VulnerableSAP
  • cpe:2.3:a:sap:s4core:103:*:*:*:*:*:*:* Versions 103 Vulnerable ·SAP
  • cpe:2.3:a:sap:s4core:104:*:*:*:*:*:*:* Versions 104 Vulnerable ·SAP
  • cpe:2.3:a:sap:s4core:105:*:*:*:*:*:*:* Versions 105 Vulnerable ·SAP
  • cpe:2.3:a:sap:sapscore:125:*:*:*:*:*:*:* Versions 125 Vulnerable ·SAP

Remediation

  • Fix · CNA DMIS Mobile Plug-In (SAP SE) Fixed in 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 2011_1_752, 2020
  • Fix · CNA SAP S/4HANA (SAP SE) Fixed in 102, 103, 104, 105

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-33701
  2. 2026-10-03 Alias added: GHSA-ch32-3mmp-49c5

References

Exploit 4

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences