CVE-2021-33703 : Under certain conditions, NetWeaver Enterprise Portal, versions

Under certain conditions, NetWeaver Enterprise Portal, versions - 7.30, 7.31, 7.40, 7.50, does not sufficiently encode URL parameters. An attacker can craft a malicious link and send it to a victim. A successful attack results in Reflected Cross-Site Scripting (XSS) vulnerability.

Published 2021-08-10 15:15:08

Updated 2022-02-04 16:24:58

Source SAP SE

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2021-33703

SAP » Netweaver Enterprise Portal » Version: 7.31
cpe:2.3:a:sap:netweaver_enterprise_portal:7.31:*:*:*:*:*:*:*
Matching versions
SAP » Netweaver Enterprise Portal » Version: 7.30
cpe:2.3:a:sap:netweaver_enterprise_portal:7.30:*:*:*:*:*:*:*
Matching versions
SAP » Netweaver Enterprise Portal » Version: 7.40
cpe:2.3:a:sap:netweaver_enterprise_portal:7.40:*:*:*:*:*:*:*
Matching versions
SAP » Netweaver Enterprise Portal » Version: 7.50
cpe:2.3:a:sap:netweaver_enterprise_portal:7.50:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2021-33703

EPSS FAQ

0.25%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 64 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-33703

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.6	LOW	AV:N/AC:H/Au:N/C:N/I:P/A:N	4.9	2.9	NIST
Access Vector: Network Access Complexity: High Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
8.3	HIGH	CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H	1.6	6.0	SAP SE
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: High Integrity: High Availability: High
6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2021-33703

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Assigned by:
- cna@sap.com (Primary)
- nvd@nist.gov (Secondary)

References for CVE-2021-33703

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806

SAP Security Patch Day – August 2021 - Product Security Response at SAP - Community Wiki
Vendor Advisory

CVEs referencing this url
http://seclists.org/fulldisclosure/2022/Jan/71

Full Disclosure: Onapsis Security Advisory 2021-0022: SAP Enterprise Portal - XSS RunContentCreation
Mailing List;Third Party Advisory
https://launchpad.support.sap.com/#/notes/3072920

SAP ONE Support Launchpad: Log On
Permissions Required;Vendor Advisory
http://packetstormsecurity.com/files/165740/SAP-Enterprise-Portal-RunContentCreation-Cross-Site-Scripting.html

SAP Enterprise Portal RunContentCreation Cross Site Scripting ≈ Packet Storm
Third Party Advisory;VDB Entry

Jump to

Vulnerability Details : CVE-2021-33703

Products affected by CVE-2021-33703

Exploit prediction scoring system (EPSS) score for CVE-2021-33703

CVSS scores for CVE-2021-33703

CWE ids for CVE-2021-33703

References for CVE-2021-33703