CVE-2021-42067

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

In SAP NetWeaver AS for ABAP and ABAP Platform - versions 701, 702, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 786, an attacker authenticated as a regular user can use the S/4 Hana dashboard to reveal systems and services which they would not normally be allowed to see. No information alteration or denial of service is possible.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
SAP SE	SAP NetWeaver AS for ABAP and ABAP Platform	< 701; < 702; < 711; < 730; < 731; < 740; < 750; < 751; < 752; < 753; < 754; < 755; < 756; < 786

References

https://launchpad.support.sap.com/#/notes/3112710Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=596902035Vendor Advisory
https://launchpad.support.sap.com/#/notes/3112710Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=596902035Vendor Advisory

Timeline

Published: Jan 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-420683.3When a user opens a manipulated GIF (.gif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the applic CVE-2021-420693.3When a user opens manipulated Tagged Image File Format (.tif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - vers CVE-2021-42078.2A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header.width` and `cursor->CVE-2021-420703.3When a user opens manipulated Jupiter Tessellation (.jt) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9 CVE-2021-420719.8In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/CVE-2021-420728.8An issue was discovered in Barrier before 2.4.0. The barriers component (aka the server-side implementation of Barrier) does not sufficientl CVE-2021-420738.2An issue was discovered in Barrier before 2.4.0. An attacker can enter an active session state with the barriers component (aka the server-s CVE-2021-420747.5An issue was discovered in Barrier before 2.3.4. An unauthenticated attacker can cause a segmentation fault in the barriers component (aka t CVE-2021-420757.5An issue was discovered in Barrier before 2.3.4. The barriers component (aka the server-side implementation of Barrier) does not correctly c CVE-2021-420767.5An issue was discovered in Barrier before 2.3.4. An attacker can cause memory exhaustion in the barriers component (aka the server-side impl CVE-2021-420779.8PHP Event Calendar before 2021-09-03 allows SQL injection, as demonstrated by the /server/ajax/user_manager.php username parameter. This can CVE-2021-420786.1PHP Event Calendar through 2021-11-04 allows persistent cross-site scripting (XSS), as demonstrated by the /server/ajax/events_manager.php t