PT-2021-20281 · Sap · Sap Netweaver Portal

Yvan Genuer · Published 2021-09-15 · Updated 2022-02-03 · CVE-2021-33705

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Portal versions 7.10 through 7.50

Description: The issue allows an unauthenticated attacker to craft a malicious URL which, when clicked by a user, can make any type of request (e.g., POST, GET) to any internal or external server. This can result in the accessing or modification of data accessible from the Portal but will not affect its availability.

Recommendations: For SAP NetWeaver Portal versions 7.10 through 7.50, consider disabling the Iviews Editor component until a patch is available to prevent exploitation of the Server-Side Request Forgery (SSRF) vulnerability. Restrict access to internal and external servers to minimize the risk of data access or modification. Avoid using malicious URLs that can trigger the vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2021-33705

Affected Products

Sap Netweaver Portal

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2021-33705 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33705 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3074844 · Note
• https://t.me/cvenotify/20909 · Telegram Post
• https://t.me/cvenotify/21565 · Telegram Post
• https://t.me/cvenotify/26195 · Telegram Post
• https://t.me/cibsecurity/28937 · Telegram Post
• https://t.me/cvenotify/20929 · Telegram Post
• http://packetstormsecurity.com/files/165743/SAP-Enterprise-Portal-iviewCatcherEditor-Server-Side-Request-Forgery.html · Note
• http://seclists.org/fulldisclosure/2022/Jan/72 · Note