Vulnerability · Published Dec 14, 2021 · Assigned by sap
CVE-2021-42063
Medium 6.1
In plain English
A medium-severity security flaw in SAP Knowledge Warehouse from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 23.4% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)23.4%top 2.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling2Nuclei, Public PoC
Official description
A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50. The usage of one SAP KW component within a Web browser enables unauthorized attackers to conduct XSS attacks, which might lead to disclose sensitive data.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP Knowledge Warehouse | < 7.30< 7.31< 7.40< 7.50 |
References
- https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021 x_refsource_MISC
- https://launchpad.support.sap.com/#/notes/3102769 x_refsource_MISC
- 20220320 [CVE-2021-42063] SAP Knowledge Warehouse <= 7.50 "SAPIrExtHelp" Reflected XSS mailing-list, x_refsource_FULLDISC
- http://packetstormsecurity.com/files/166369/SAP-Knowledge-Warehouse-7.50-7.40-7.31-7.30-Cross-Site-Scripting.html x_refsource_MISC