CVE-2021-33664
5.4
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
SAP NetWeaver Application Server ABAP (Applications based on Web Dynpro ABAP), versions - SAP_UI - 750,752,753,754,755, SAP_BASIS - 702, 731 does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| SAP SE | SAP NetWeaver Application Server ABAP (Applications based on Web Dynpro ABAP) | < SAP_UI - 750 | affected |
| SAP SE | SAP NetWeaver Application Server ABAP (Applications based on Web Dynpro ABAP) | < 752 | affected |
| SAP SE | SAP NetWeaver Application Server ABAP (Applications based on Web Dynpro ABAP) | < 753 | affected |
| SAP SE | SAP NetWeaver Application Server ABAP (Applications based on Web Dynpro ABAP) | < 754 | affected |
| SAP SE | SAP NetWeaver Application Server ABAP (Applications based on Web Dynpro ABAP) | < 755 | affected |
| SAP SE | SAP NetWeaver Application Server ABAP (Applications based on Web Dynpro ABAP) | < SAP_BASIS - 702 | affected |
| SAP SE | SAP NetWeaver Application Server ABAP (Applications based on Web Dynpro ABAP) | < 31 | affected |
Weaknesses
- Cross Site Scripting
ADP Enrichment
CVE Program Container
Additional References
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999
- https://launchpad.support.sap.com/#/notes/3025604
References
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999
- https://launchpad.support.sap.com/#/notes/3025604
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.