CVE-2021-40499

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Client-side printing services SAP Cloud Print Manager and SAPSprint for SAP NetWeaver Application Server for ABAP - versions 7.70, 7.70 PI, 7.70 BYD, allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
SAP SE	SAP NetWeaver Application Server for ABAP (SAP Cloud Print Manager and SAPSprint)	< 7.70; < 7.70 PI; < 7.70BYD

References

https://launchpad.support.sap.com/#/notes/3100882Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983Vendor Advisory
https://launchpad.support.sap.com/#/notes/3100882Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983Vendor Advisory

Timeline

Published: Oct 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-40506.1livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-405007.5SAP BusinessObjects Business Intelligence Platform (Crystal Reports) - versions 420, 430, allows an unauthenticated attacker to exploit miss CVE-2021-405018.1SAP ABAP Platform Kernel - versions 7.77, 7.81, 7.85, 7.86, does not perform necessary authorization checks for an authenticated business us CVE-2021-405028.8SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, result CVE-2021-405037.8An information disclosure vulnerability exists in SAP GUI for Windows - versions < 7.60 PL13, 7.70 PL4, which allows an attacker with suffic CVE-2021-405044.9A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 75 CVE-2021-405069.8An issue was discovered in the ALU unit of the OR1200 (aka OpenRISC 1200) processor 2011-09-10 through 2015-11-11. The overflow flag is not CVE-2021-405079.8An issue was discovered in the ALU unit of the OR1200 (aka OpenRISC 1200) processor 2011-09-10 through 2015-11-11. The overflow flag is not CVE-2021-405095.4ViewCommon.java in JForum2 2.7.0 allows XSS via a user signature.CVE-2021-405107.5XML eXternal Entity (XXE) in OBDA systems’ Mastro 1.0 allows remote attackers to read system files via custom DTDs.CVE-2021-405117.5OBDA systems’ Mastro 1.0 is vulnerable to XML Entity Expansion (aka “billion laughs”) attack allowing denial of service.CVE-2021-405167.5WeeChat before 3.2.1 allows remote attackers to cause a denial of service (crash) via a crafted WebSocket frame that trigger an out-of-bound