Read the docs
TI-2021-15423 Aliases CVE-2021-37531GHSA-wjr5-qv82-83cr

OS command injection in SAP NetWeaver Knowledge Management XML Forms

Priority MEDIUM 44CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

SAP NetWeaver Knowledge Management XML Forms versions - 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, contains an XSLT vulnerability which allows a non-administrative authenticated attacker to craft a malicious XSL stylesheet file containing a script with OS-level commands, copy it into a location to be accessed by the system and then create a file which will trigger the XSLT engine to execute the script contained within the malicious XSL file. This can result in a full compromise of the confidentiality, integrity, and availability of the system.

Why it matters now

EPSS 0.03155 88th percentileScored 2026-11-07
Fix Fixed SAP NetWeaver Knowledge Management XML Forms (SAP SE): 7.10, 7.11, 7.30 +3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP NetWeaver Knowledge Management XML Formsbefore 7.10; before 7.11; before 7.30; before 7.31; before 7.40; before 7.507.10, 7.11, 7.30, 7.31, 7.40, 7.50Patch availableCNA
  • SAP NetWeaver Knowledge Management XML Forms VendorSAP Affected before 7.10; before 7.11; before 7.30; before 7.31; before 7.40; before 7.50 Fixed in 7.10, 7.11, 7.30, 7.31, 7.40, 7.50 Patch available CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:sap:netweaver_knowledge_management_xml_forms:7.10:*:*:*:*:*:*:*7.10VulnerableSAP
cpe:2.3:a:sap:netweaver_knowledge_management_xml_forms:7.11:*:*:*:*:*:*:*7.11VulnerableSAP
cpe:2.3:a:sap:netweaver_knowledge_management_xml_forms:7.30:*:*:*:*:*:*:*7.30VulnerableSAP
cpe:2.3:a:sap:netweaver_knowledge_management_xml_forms:7.31:*:*:*:*:*:*:*7.31VulnerableSAP
cpe:2.3:a:sap:netweaver_knowledge_management_xml_forms:7.40:*:*:*:*:*:*:*7.40VulnerableSAP
cpe:2.3:a:sap:netweaver_knowledge_management_xml_forms:7.50:*:*:*:*:*:*:*7.50VulnerableSAP
  • cpe:2.3:a:sap:netweaver_knowledge_management_xml_forms:7.10:*:*:*:*:*:*:* Versions 7.10 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_knowledge_management_xml_forms:7.11:*:*:*:*:*:*:* Versions 7.11 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_knowledge_management_xml_forms:7.30:*:*:*:*:*:*:* Versions 7.30 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_knowledge_management_xml_forms:7.31:*:*:*:*:*:*:* Versions 7.31 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_knowledge_management_xml_forms:7.40:*:*:*:*:*:*:* Versions 7.40 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_knowledge_management_xml_forms:7.50:*:*:*:*:*:*:* Versions 7.50 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP NetWeaver Knowledge Management XML Forms (SAP SE) Fixed in 7.10, 7.11, 7.30, 7.31, 7.40, 7.50

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-37531
  2. 2026-10-03 Alias added: GHSA-wjr5-qv82-83cr

References

Advisory 3

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences