CVE-2021-33670 : SAP NetWeaver AS for Java (Http Service Monitoring Filter), versions

SAP NetWeaver AS for Java (Http Service Monitoring Filter), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send multiple HTTP requests with different method types thereby crashing the filter and making the HTTP server unavailable to other legitimate users leading to denial of service vulnerability.

Published 2021-07-14 12:15:08

Updated 2022-05-12 20:15:55

Source SAP SE

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2021-33670

SAP » Netweaver Application Server Java » Version: 7.50
cpe:2.3:a:sap:netweaver_application_server_java:7.50:*:*:*:*:*:*:*
Matching versions
SAP » Netweaver Application Server Java » Version: 7.40
cpe:2.3:a:sap:netweaver_application_server_java:7.40:*:*:*:*:*:*:*
Matching versions
SAP » Netweaver Application Server Java » Version: 7.30
cpe:2.3:a:sap:netweaver_application_server_java:7.30:*:*:*:*:*:*:*
Matching versions
SAP » Netweaver Application Server Java » Version: 7.20
cpe:2.3:a:sap:netweaver_application_server_java:7.20:*:*:*:*:*:*:*
Matching versions
SAP » Netweaver Application Server Java » Version: 7.31
cpe:2.3:a:sap:netweaver_application_server_java:7.31:*:*:*:*:*:*:*
Matching versions
SAP » Netweaver Application Server Java » Version: 7.10
cpe:2.3:a:sap:netweaver_application_server_java:7.10:*:*:*:*:*:*:*
Matching versions
SAP » Netweaver Application Server Java » Version: 7.11
cpe:2.3:a:sap:netweaver_application_server_java:7.11:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2021-33670

EPSS FAQ

1.09%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 84 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-33670

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	SAP SE
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

References for CVE-2021-33670

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506

SAP Security Patch Day – July 2021 - Product Security Response at SAP - Community Wiki
Vendor Advisory

CVEs referencing this url
http://packetstormsecurity.com/files/166965/SAP-NetWeaver-Java-Denial-Of-Service.html

SAP NetWeaver Java Denial Of Service ≈ Packet Storm
Patch;Third Party Advisory;VDB Entry
http://seclists.org/fulldisclosure/2022/May/4

Full Disclosure: Onapsis Security Advisory 2022-0002: Denial of Service in SAP NetWeaver JAVA
Mailing List;Patch;Third Party Advisory
https://launchpad.support.sap.com/#/notes/3056652

SAP ONE Support Launchpad: Log On
Permissions Required

Jump to

Vulnerability Details : CVE-2021-33670

Products affected by CVE-2021-33670

Exploit prediction scoring system (EPSS) score for CVE-2021-33670

CVSS scores for CVE-2021-33670

References for CVE-2021-33670