CVE-2021-33705

8.1HIGH

Key Information:

Vendor
SAP
Status
SAP Netweaver Enterprise Portal
Vendor
CVE Published:
15 September 2021

Summary

The SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, component Iviews Editor contains a Server-Side Request Forgery (SSRF) vulnerability which allows an unauthenticated attacker to craft a malicious URL which when clicked by a user can make any type of request (e.g. POST, GET) to any internal or external server. This can result in the accessing or modification of data accessible from the Portal but will not affect its availability.

Affected Version(s)

SAP NetWeaver Enterprise Portal < 7.10 < 7.10

SAP NetWeaver Enterprise Portal < 7.11 < 7.11

SAP NetWeaver Enterprise Portal < 7.20 < 7.20

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/3074844
x_refsource_MISC
http://seclists.org/fulldisclosure/2022/Jan/72
mailing-listx_refsource_FULLDISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.