TI-2021-17546 Aliases CVE-2021-40499 GHSA-fwc2-3ffv-pvfm

Code injection in SAP NetWeaver Application Server for ABAP

MEDIUM 44CWE-94Published 2021-10-12 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-94.

Summary

Client-side printing services SAP Cloud Print Manager and SAPSprint for SAP NetWeaver Application Server for ABAP - versions 7.70, 7.70 PI, 7.70 BYD, allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.

Why it matters now

EPSS 0.0116 67th percentileScored 2026-11-07

Fix Fixed SAP NetWeaver Application Server for ABAP (SAP Cloud Print Manager and SAPSprint) (SAP SE): 7.70, 7.70BYD

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP NetWeaver Application Server for ABAP (SAP Cloud Print Manager and SAPSprint)	before 7.70; < 7.70 PI; before 7.70BYD	7.70, 7.70BYD	Patch available	CNA

SAP NetWeaver Application Server for ABAP (SAP Cloud Print Manager and SAPSprint) VendorSAP Affected before 7.70; < 7.70 PI; before 7.70BYD Fixed in 7.70, 7.70BYD Patch available CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:netweaver_application_server_abap:7.70:::::::*	7.70	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:7.70_pi:::::::*	7.70_pi	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:7.70byd:::::::*	7.70byd	Vulnerable	SAP

cpe:2.3:a:sap:netweaver_application_server_abap:7.70:*:*:*:*:*:*:* Versions 7.70 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:7.70_pi:*:*:*:*:*:*:* Versions 7.70_pi Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:7.70byd:*:*:*:*:*:*:* Versions 7.70byd Vulnerable ·SAP

Remediation

Fix · CNA SAP NetWeaver Application Server for ABAP (SAP Cloud Print Manager and SAPSprint) (SAP SE) Fixed in 7.70, 7.70BYD

Timeline

2026-10-02 Threatist record created from CVE-2021-40499
2026-10-03 Alias added: GHSA-fwc2-3ffv-pvfm

References

Advisory 1

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983

Other 1

https://launchpad.support.sap.com/#/notes/3100882

TI-2022-06811 SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP… KEVCVSS 3.1CRITICAL 10.0
TI-2023-21149 Missing Authorization check in SAP CommonCryptoLib CVSS 3.1CRITICAL 9.8
TI-2023-12229 Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform CVSS 3.1CRITICAL 9.6
TI-2023-12228 Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform CVSS 3.1CRITICAL 9.6
TI-2021-19921 Code injection in SAP ABAP Server & ABAP Platform CVSS 3.1CRITICAL 9.8
TI-2021-09062 Improper authentication in SAP NetWeaver AS ABAP and ABAP Platform CVSS 3.1CRITICAL 9.8

See all 85 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences