Vulnerability · Published Aug 10, 2021 · Assigned by sap
CVE-2021-33703
High 8.3
In plain English
A high-severity cross-site scripting in SAP NetWeaver Enterprise Portal (Application Extensions) from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).
Severity (CVSS 3.0)8.3High
Exploit odds (30 days)1.5%top 25.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Under certain conditions, NetWeaver Enterprise Portal, versions - 7.30, 7.31, 7.40, 7.50, does not sufficiently encode URL parameters. An attacker can craft a malicious link and send it to a victim. A successful attack results in Reflected Cross-Site Scripting (XSS) vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP NetWeaver Enterprise Portal (Application Extensions) | < 7.30< 7.31< 7.40< 7.50 |
Weakness: CWE-79 · Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806 x_refsource_MISC
- https://launchpad.support.sap.com/#/notes/3072920 x_refsource_MISC
- 20220126 Onapsis Security Advisory 2021-0022: SAP Enterprise Portal - XSS RunContentCreation mailing-list, x_refsource_FULLDISC
- http://packetstormsecurity.com/files/165740/SAP-Enterprise-Portal-RunContentCreation-Cross-Site-Scripting.html x_refsource_MISC