Log in Start free

Vulnerability · Published Sep 15, 2021 · Assigned by sap

CVE-2021-33690

Critical 9.9

In plain English

A critical-severity security flaw in SAP NetWeaver Development Infrastructure (Component Build Service) from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 69.1% (higher than 99.4% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 3.0)9.9Critical
Exploit odds (30 days)69.1%top 0.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling2Nuclei, Public PoC

Official description

Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP NetWeaver Development Infrastructure Component Build Service allows a threat actor who has access to the server to perform proxy attacks on server by sending crafted queries. Due to this, the threat actor could completely compromise sensitive data residing on the Server and impact its availability.Note: The impact of this vulnerability depends on whether SAP NetWeaver Development Infrastructure (NWDI) runs on the intranet or internet. The CVSS score reflects the impact considering the worst-case scenario that it runs on the internet.

Affected products (as reported)

VendorProductVersions
SAP SE SAP NetWeaver Development Infrastructure (Component Build Service) < 7.11< 7.20< 7.30< 7.31< 7.40< 7.50

References