PT-2021-14558 · Sap · Sap Netweaver Application Server Java

Igor Souza · Published 2021-04-13 · Updated 2021-04-20 · CVE-2021-21492

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java (HTTP Service) versions 7.10 through 7.50

Description The issue arises from insufficient validation of logon groups in URLs, leading to a content spoofing issue when directory listing is enabled.

Recommendations For versions 7.10 through 7.50, consider disabling directory listing to minimize the risk of exploitation. As a temporary workaround, restrict access to the HTTP Service until a patch is available.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2021-21492

Affected Products

Sap Netweaver Application Server Java

References · 4

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21492 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21492 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3025637 · Note