The SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, component Iviews Editor contains a Server-Side Request Forgery (SSRF) vulnerability which allows an unauthenticated attacker to craft a malicious URL which when clicked by a user can make any type of request (e.g. POST, GET) to any internal or external server. This can result in the accessing or modification of data accessible from the Portal but will not affect its availability.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/165743/SAP-Enterprise-Portal-iviewCatcherEditor-Server-Side-Request-Forgery.html | Third Party Advisory VDB Entry |
| http://seclists.org/fulldisclosure/2022/Jan/72 | Mailing List Third Party Advisory |
| https://launchpad.support.sap.com/#/notes/3074844 | Permissions Required |
| https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806 | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
02 Feb 2022, 21:30
| Type | Values Removed | Values Added |
|---|---|---|
| References | (FULLDISC) http://seclists.org/fulldisclosure/2022/Jan/72 - Mailing List, Third Party Advisory | |
| References | (MISC) http://packetstormsecurity.com/files/165743/SAP-Enterprise-Portal-iviewCatcherEditor-Server-Side-Request-Forgery.html - Third Party Advisory, VDB Entry |
27 Jan 2022, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
26 Jan 2022, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
28 Sep 2021, 15:03
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 5.8
v3 : 8.1 |
| CWE | CWE-918 | |
| CPE | cpe:2.3:a:sap:netweaver_portal:7.20:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_portal:7.40:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_portal:7.31:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_portal:7.10:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_portal:7.30:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_portal:7.11:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_portal:7.50:*:*:*:*:*:*:* |
|
| References | (MISC) https://launchpad.support.sap.com/#/notes/3074844 - Permissions Required | |
| References | (MISC) https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806 - Patch, Vendor Advisory |
15 Sep 2021, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-09-15 19:15
Updated : 2024-02-04 22:08
NVD link : CVE-2021-33705
Mitre link : CVE-2021-33705
CVE.ORG link : CVE-2021-33705
JSON object : View
Products Affected
sap
- netweaver_portal
CWE
CWE-918
Server-Side Request Forgery (SSRF)