SAP NetWeaver - RCE (CVE-2021-38163)
Description
SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.
psychologyCrowdSec Analysis
CVE-2021-38163 is a path traversal vulnerability in SAP NetWeaver (Visual Composer 7.0 RT) versions 7.30 through 7.50, allowing authenticated non-administrative users to upload and execute malicious files. Exploitation of this flaw enables attackers to run arbitrary operating system commands with the privileges of the Java Server process, potentially leading to data theft, server modification, or complete denial of service.
CrowdSec has been tracking this vulnerability and its exploits since 27th of May 2025.
CrowdSec has not observed any significant exploitation activity targeting CVE-2021-38163 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit SAP NetWeaver AS by uploading a malicious JSP webshell using a path traversal in the parName parameter, then execute arbitrary commands via the /rtmfCommunicator/html/urgent.jsp endpoint using the cve query parameter.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2021-09-14 |
| CISA KEV | 2022-06-09 |
| CISA Remediation Deadline | 2022-06-30 |
| Rule Released | 2025-05-27 |