CVE-2021-33687

Katalog CVE

CVSS 4.9 · Medium EPSS 1,6%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada sap netweaver application server java. Skor CVSS 3.1 4.9 (Medium) menurut NVD.

Deskripsi (NVD)

SAP NetWeaver AS JAVA (Enterprise Portal), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 reveals sensitive information in one of their HTTP requests, an attacker can use this in conjunction with other attacks such as XSS to steal this information.

Rincian

Terbit di NVD

14 Juli 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 75,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 advisory vendor
• http://packetstormsecurity.com/files/164600/SAP-Enterprise-Portal-Sensitive-Data-Disclosure.html patch · advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2021/Oct/32 mailing list · patch · advisory pihak ketiga
• https://launchpad.support.sap.com/#/notes/3059764 permissions required