PT-2021-14556 · Sap · Sap Netweaver As Abap

Published 2021-06-09 · Updated 2022-10-05 · CVE-2021-21490

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS for ABAP (Web Survey) versions 700 through 75F

Description The issue arises from insufficient encoding of input and output parameters, leading to a reflected cross-site scripting vulnerability. This allows a malicious user to access data related to the current session, potentially impersonating a user and gaining access to all information with the same rights as the target user.

Recommendations For SAP NetWeaver AS for ABAP (Web Survey) versions 700 through 75F, update to a version that properly encodes input and output parameters to prevent reflected cross-site scripting attacks.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-21490

Affected Products

Sap Netweaver As Abap

References · 4

• https://launchpad.support.sap.com/#/notes/3004043 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21490 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21490 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999 · Vendor Advisory