Lucene search

[email protected]CVE-2021-33707

HistoryAug 10, 2021 - 3:15 p.m.

CVE-2021-33707

2021-08-1015:15:00

CWE-601

[email protected]

web.nvd.nist.gov

sap

netweaver

knowledge management

cve-2021-33707

url redirection

phishing

security vulnerability

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.1 Medium

AI Score

Confidence

High

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.002 Low

EPSS

Percentile

61.0%

JSON

SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL stored in a component. This could enable the attacker to compromise the user’s confidentiality and integrity.

CPENameOperatorVersion
sap:netweaver_knowledge_managementsap netweaver knowledge managementeq7.31
sap:netweaver_knowledge_managementsap netweaver knowledge managementeq7.40
sap:netweaver_knowledge_managementsap netweaver knowledge managementeq7.50
sap:netweaver_knowledge_managementsap netweaver knowledge managementeq7.30

CPE	Name	Operator	Version
sap:netweaver_knowledge_management	sap netweaver knowledge management	eq	7.31
sap:netweaver_knowledge_management	sap netweaver knowledge management	eq	7.40
sap:netweaver_knowledge_management	sap netweaver knowledge management	eq	7.50
sap:netweaver_knowledge_management	sap netweaver knowledge management	eq	7.30

References

packetstormsecurity.com/files/165748/SAP-Enterprise-Portal-Open-Redirect.html

seclists.org/fulldisclosure/2022/Jan/73

launchpad.support.sap.com/#/notes/3076399

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.1 Medium

AI Score

Confidence

High

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.002 Low

EPSS

Percentile

61.0%

JSON

Related for CVE-2021-33707

prion1 threatpost1