Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-21467 State: PUBLISHED Published: 2021-01-12T14:41:45 Last Updated: 2024-08-03T18:16:22.518Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP SE Products: SAP Banking Services (Generic Market Data) Problem Types: Missing Authorization Check Description: SAP Banking Services (Generic Market Data) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. An unauthorized User is allowed to display restricted Business Partner Generic Market Data (GMD), due to improper authorization check. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages
uthorization check. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476 - https://launchpad.support.sap.com/#/notes/3008422
CVE ID: CVE-2021-21468 State: PUBLISHED Published: 2021-01-12T14:40:53 Last Updated: 2024-08-03T18:16:22.575Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SAP SE Products: SAP Business Warehouse Problem Types: Missing Authorization check Description: The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges that allows the user to practically read out any database table. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476 - https://launchpad.support.sap.com/#/notes/2986980 - http://seclists.org/
m/wiki/pages/viewpage.action?pageId=564760476 - https://launchpad.support.sap.com/#/notes/2986980 - http://seclists.org/fulldisclosure/2022/May/42 - http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html
CVE ID: CVE-2021-21469 State: PUBLISHED Published: 2021-01-12T14:44:32 Last Updated: 2024-08-03T18:16:22.563Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: SAP SE Products: SAP NetWeaver Master Data Management Problem Types: Information Disclosure Description: When security guidelines for SAP NetWeaver Master Data Management running on windows have not been thoroughly reviewed, it might be possible for an external operator to try and set custom paths in the MDS server configuration. When no adequate protection has been enforced on any level (e.g., MDS Server password not set, network and OS configuration not properly secured, etc.), a malicious user might
el (e.g., MDS Server password not set, network and OS configuration not properly secured, etc.), a malicious user might define UNC paths which could then be exploited to put the system at risk using a so-called SMB relay attack and obtain highly sensitive data, which leads to Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476 - https://launchpad.support.sap.com/#/notes/2993032
CVE ID: CVE-2021-21470 State: PUBLISHED Published: 2021-01-12T14:41:08 Last Updated: 2024-08-03T18:16:22.407Z Severity: LOW (CVSS 3.6 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: SAP SE Products: SAP EPM Add-in for Microsoft Office, SAP EPM Add-in for SAP Analysis Office Problem Types: XML External Entity Reference (XXE) Description: SAP EPM Add-in for Microsoft Office, version - 1010 and SAP EPM Add-in for SAP Analysis Office, version - 2.8, allows an authenticated attacker with user privileges to parse malicious XML files which could result in XXE-based attacks in applications that accept attacker-controlled XML configuration files. This occurs as logging service does not disable
in applications that accept attacker-controlled XML configuration files. This occurs as logging service does not disable XML external entities when parsing configuration files and a successful exploit would result in limited impact on integrity and availability of the application. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476 - https://launchpad.support.sap.com/#/notes/3000291
CVE ID: CVE-2021-21471 State: PUBLISHED Published: 2021-01-12T14:21:12 Last Updated: 2024-08-03T18:16:22.458Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: SAP SE Products: CLA-Assistant Problem Types: Improper Access Control Description: In CLA-Assistant, versions before 2.8.5, due to improper access control an authenticated user could access API endpoints which are not intended to be used by the user. This could impact the integrity of the application. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cla-assistant/cla-assistant/security/advisories/GHSA-4h6f-c68c-pxhr
CVE ID: CVE-2021-21472 State: PUBLISHED Published: 2021-02-09T20:43:38 Last Updated: 2024-08-03T18:16:22.534Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SAP SE Products: SAP Software Provisioning Manager 1.0 (SAP NetWeaver Master Data Management Server 7.1) Problem Types: Weak Password Requirements Description: SAP Software Provisioning Manager 1.0 (SAP NetWeaver Master Data Management Server 7.1) does not have an option to set password during its installation, this allows an authenticated attacker to perform various security attacks like Directory Traversal, Password Brute force Attack, SMB Relay attack, Security Downgrade. Additional Analyst Notes: -
ike Directory Traversal, Password Brute force Attack, SMB Relay attack, Security Downgrade. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2998173 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543
CVE ID: CVE-2021-21473 State: PUBLISHED Published: 2021-06-09T13:23:48 Last Updated: 2024-08-03T18:16:22.654Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SAP SE Products: SAP NetWeaver AS ABAP and ABAP Platform (SRM_RFC_SUBMIT_REPORT) Problem Types: Missing Authorization Description: SAP NetWeaver AS ABAP and ABAP Platform, versions - 700, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, contains function module SRM_RFC_SUBMIT_REPORT which fails to validate authorization of an authenticated user thus allowing an unauthorized user to execute reports in SAP NetWeaver ABAP Platform. Additional Analyst Notes: - CVE Program Container: References: -
user to execute reports in SAP NetWeaver ABAP Platform. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999 - https://launchpad.support.sap.com/#/notes/3002517 - http://seclists.org/fulldisclosure/2022/May/42 - http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html
CVE ID: CVE-2021-21474 State: PUBLISHED Published: 2021-02-09T20:44:04 Last Updated: 2024-08-03T18:16:22.595Z Vendors: SAP SE Products: SAP HANA Database Problem Types: Improper Authentication Description: SAP HANA Database, versions - 1.0, 2.0, accepts SAML tokens with MD5 digest, an attacker who manages to obtain an MD5-digest signed SAML Assertion issued for an SAP HANA instance might be able to tamper with it and alter it in a way that the digest continues to be the same and without invalidating the digital signature, this allows them to impersonate as user in HANA database and be able to read the contents in the database. Additional Analyst Notes: - CVE Program Container: References: -
base and be able to read the contents in the database. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543 - https://launchpad.support.sap.com/#/notes/2992154
CVE ID: CVE-2021-21475 State: PUBLISHED Published: 2021-02-09T20:43:48 Last Updated: 2024-08-03T18:16:22.448Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: SAP SE Products: SAP NetWeaver Master Data Management Server Problem Types: Directory Traversal Description: Under specific circumstances SAP Master Data Management, versions - 710, 710.750, allows an unauthorized attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs. Due to this Directory Traversal vulnerability the attacker could read content of arbitrary files on the remote ser
APIs. Due to this Directory Traversal vulnerability the attacker could read content of arbitrary files on the remote server and expose sensitive data. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/3000897 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543
CVE ID: CVE-2021-21476 State: PUBLISHED Published: 2021-02-09T20:44:32 Last Updated: 2024-08-03T18:16:22.644Z Severity: MEDIUM (CVSS 4.7 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: SAP SE Products: SAP UI5 Problem Types: Tabnabbing Description: SAP UI5 versions before 1.38.49, 1.52.49, 1.60.34, 1.71.31, 1.78.18, 1.84.5, 1.85.4, 1.86.1 allows an unauthenticated attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543 - https://launchpad.support.sap.com/#/notes/3014303
CVE ID: CVE-2021-21477 State: PUBLISHED Published: 2021-02-09T20:43:57 Last Updated: 2024-08-03T18:16:22.468Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Commerce Problem Types: Remote Code Execution Description: SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with this privilege will be able to inject malicious code in the drools rules which when executed leads to Remote Code Execution vulnerability enabling the attacker to compromise the underlying host enabling him to impair confidentiality, integrity and availability of the a
e attacker to compromise the underlying host enabling him to impair confidentiality, integrity and availability of the application. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543 - https://launchpad.support.sap.com/#/notes/3014121
CVE ID: CVE-2021-21478 State: PUBLISHED Published: 2021-02-09T20:44:40 Last Updated: 2024-08-03T18:16:22.606Z Severity: MEDIUM (CVSS 4.7 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: SAP SE Products: SAP NetWeaver AS ABAP (Web Dynpro ABAP) Problem Types: Tabnabbing Description: SAP Web Dynpro ABAP allow an attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543 - https://launchpad.support.sap.com/#/notes/2974582
CVE ID: CVE-2021-21479 State: PUBLISHED Published: 2021-02-09T20:49:20 Last Updated: 2024-08-03T18:16:22.634Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) Vendors: SAP SE Products: SCIMono Problem Types: Remote Code Execution Description: In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availability and integrity of the system. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SAP/scimono/security/advisories/GHSA-29q4-gxjq-rx5c
CVE ID: CVE-2021-21480 State: PUBLISHED Published: 2021-03-09T14:10:47.000Z Last Updated: 2025-05-05T16:55:02.195Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Manufacturing Integration and Intelligence Problem Types: Code Execution Description: SAP MII allows users to create dashboards and save them as JSP through the SSCE (Self Service Composition Environment). An attacker can intercept a request to the server, inject malicious JSP code in the request and forward to server. When this dashboard is opened by users having at least SAP_XMII Developer role, malicious content in the dashboard gets executed, leading to remote code execut
having at least SAP_XMII Developer role, malicious content in the dashboard gets executed, leading to remote code execution in the server, which allows privilege escalation. The malicious JSP code can contain certain OS commands, through which an attacker can read sensitive files in the server, modify files or even delete contents in the server thus compromising the confidentiality, integrity and availability of the server hosting the SAP MII application. Also, an attacker authenticated as a developer can use the application to upload and execute a file which will permit them to execute operating systems commands completely compromising the server hosting the application. Additional Analyst
em to execute operating systems commands completely compromising the server hosting the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107 - https://launchpad.support.sap.com/#/notes/3022622 - http://seclists.org/fulldisclosure/2021/Jun/30 - http://packetstormsecurity.com/files/163164/SAP-XMII-Remote-Code-Execution.html - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2021-21481 State: PUBLISHED Published: 2021-03-09T14:05:51 Last Updated: 2024-08-03T18:16:22.540Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP SE Products: SAP NetWeaver AS JAVA (MigrationService) Problem Types: Missing Authorization Description: The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization check. This might allow an unauthorized attacker to access configuration objects, including such that grant administrative privileges. This could result in complete compromise of system confidentiality, integrity, and availability. Additional Analyst Notes: -
could result in complete compromise of system confidentiality, integrity, and availability. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/3022422 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107
CVE ID: CVE-2021-21482 State: PUBLISHED Published: 2021-04-13T18:39:52 Last Updated: 2024-08-03T18:16:22.607Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: SAP SE Products: SAP NetWeaver Master Data Management Problem Types: Information disclosure Description: SAP NetWeaver Master Data Management, versions - 710, 710.750, allows a malicious unauthorized user with access to the MDM Server subnet to find the password using a brute force method. If successful, the attacker could obtain access to highly sensitive data and MDM administrative privileges leading to information disclosure vulnerability thereby affecting the confidentiality and integrity of the appli
vileges leading to information disclosure vulnerability thereby affecting the confidentiality and integrity of the application. This happens when security guidelines and recommendations concerning administrative accounts of an SAP NetWeaver Master Data Management installation have not been thoroughly reviewed. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/3017908 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649
CVE ID: CVE-2021-21483 State: PUBLISHED Published: 2021-04-13T18:39:17 Last Updated: 2024-08-03T18:16:22.566Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L) Vendors: SAP SE Products: SAP Solution Manager Problem Types: Information Disclosure Description: Under certain conditions SAP Solution Manager, version - 720, allows a high privileged attacker to get access to sensitive information which has a direct serious impact beyond the exploitable component thereby affecting the confidentiality in the application. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/3017823 - https://wiki.scn.sap.com/wiki/pages/viewpage
ontainer: References: - https://launchpad.support.sap.com/#/notes/3017823 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649
CVE ID: CVE-2021-21484 State: PUBLISHED Published: 2021-03-09T14:11:24 Last Updated: 2024-08-03T18:16:22.549Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: SAP SE Products: SAP HANA Problem Types: Authentication Bypass Description: LDAP authentication in SAP HANA Database version 2.0 can be bypassed if the attached LDAP directory server is configured to enable unauthenticated bind. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107 - https://launchpad.support.sap.com/#/notes/3017378
CVE ID: CVE-2021-21485 State: PUBLISHED Published: 2021-04-13T18:44:47 Last Updated: 2024-08-03T18:16:22.530Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: SAP SE Products: SAP NetWeaver AS for JAVA (Telnet Commands) Problem Types: Information Disclosure Description: An unauthorized attacker may be able to entice an administrator to invoke telnet commands of an SAP NetWeaver Application Server for Java that allow the attacker to gain NTLM hashes of a privileged user. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649 - https://launchpad.support.sap.com/#/notes/3001824
CVE ID: CVE-2021-21486 State: PUBLISHED Published: 2021-03-09T14:07:48 Last Updated: 2024-08-03T18:16:23.023Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: SAP SE Products: SAP Enterprise Financial Services (Bank Customer Accounts) Problem Types: Missing Authorization check Description: SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107 - https://laun
CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107 - https://launchpad.support.sap.com/#/notes/3007888
CVE ID: CVE-2021-21487 State: PUBLISHED Published: 2021-03-09T14:11:05 Last Updated: 2024-08-03T18:16:22.474Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) Vendors: SAP SE Products: SAP Payment Engine Problem Types: Missing Authorization check Description: SAP Payment Engine version 500, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107 - https://launchpad.support.sap.com/#/notes/3023778
CVE ID: CVE-2021-21488 State: PUBLISHED Published: 2021-03-09T14:07:10 Last Updated: 2024-08-03T18:16:22.566Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: SAP SE Products: SAP NetWeaver Knowledge Management Problem Types: Insecure Deserialization Description: Knowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with basic privileges to deserialize user-controlled data without verification, leading to insecure deserialization which triggers the attacker’s code, therefore impacting Availability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571
nal Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107 - https://launchpad.support.sap.com/#/notes/2983436
CVE ID: CVE-2021-21489 State: PUBLISHED Published: 2021-09-14T11:15:14 Last Updated: 2024-08-03T18:16:22.533Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP NetWeaver Enterprise Portal Problem Types: Cross-Site Scripting Description: SAP NetWeaver Enterprise Portal versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user related data, resulting in Stored Cross-Site Scripting (XSS) vulnerability. This would allow an attacker with administrative privileges to store a malicious script on the portal. The execution of the script content by a victim registered on the portal could compromise the confidentiality an
portal. The execution of the script content by a victim registered on the portal could compromise the confidentiality and integrity of portal content. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/3082219 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405
CVE ID: CVE-2021-21490 State: PUBLISHED Published: 2021-06-09T13:23:40 Last Updated: 2024-08-03T18:16:22.657Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP NetWeaver AS for ABAP (Web Survey) Problem Types: Cross Site Scripting Description: SAP NetWeaver AS for ABAP (Web Survey), versions - 700, 702, 710, 711, 730, 731, 750, 750, 752, 75A, 75F, does not sufficiently encode input and output parameters which results in reflected cross site scripting vulnerability, through which a malicious user can access data relating to the current session and use it to impersonate a user and access all information with the same rights as the target use
o the current session and use it to impersonate a user and access all information with the same rights as the target user. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/3004043 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999
CVE ID: CVE-2021-21491 State: PUBLISHED Published: 2021-03-10T14:11:46 Last Updated: 2024-08-03T18:16:22.599Z Severity: MEDIUM (CVSS 4.7 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: SAP SE Products: SAP NetWeaver Application Server Java (Applications based on Web Dynpro Java) Problem Types: Reverse Tabnabbing Description: SAP Netweaver Application Server Java (Applications based on WebDynpro Java) versions 7.00, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allow an attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107
alyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107 - https://launchpad.support.sap.com/#/notes/2976947
CVE ID: CVE-2021-21492 State: PUBLISHED Published: 2021-04-13T18:40:20 Last Updated: 2024-08-03T18:16:22.651Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: SAP SE Products: SAP NetWeaver AS for JAVA (HTTP Service) Problem Types: CWE-290 Description: SAP NetWeaver Application Server Java(HTTP Service), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate logon group in URLs, resulting in a content spoofing vulnerability when directory listing is enabled. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649 - https://launchpad.support.sap.com/#/not
rences: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649 - https://launchpad.support.sap.com/#/notes/3025637