CVE-2021-21492

Sep 3, 2024

Published Date: 2021-04-13T19:15Z

Last Modified: 2021-04-20T22:23Z

CVSS Score: 4.3 (MEDIUM)

EPSS Score: 0.08%

Risk Score: 3.01 (MEDIUM)

Risk Score based on CVSS score and EPSS. This score is for reference purposes and is not internationally recognized.

CVSS: 4.3 | EPSS: 0.08%

NVD Links:

https://nvd.nist.gov/vuln/detail/CVE-2021-21492

Description: SAP NetWeaver Application Server Java(HTTP Service), versions – 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate logon group in URLs, resulting in a content spoofing vulnerability when directory listing is enabled.

Mitre ATT&CK Technical v15.1

T1583.004 – Server
T1584.004 – Server
T1053.002 – At

Technical Analysis & Mitigation Measures

Reference Links

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649
https://launchpad.support.sap.com/#/notes/3025637

Vendor - Produce - Version

netweaver_application_server_java - sap, netweaver_application_server_java - sap, netweaver_application_server_java - sap, netweaver_application_server_java - sap, netweaver_application_server_java - sap, netweaver_application_server_java - sap, netweaver_application_server_java - sap

Disclaimer

The content on this website is automatically sourced from external websites such as the National Vulnerability Database (NVD), GitHub, and other security-related sources. This content is for reference purposes only, and we are not responsible for the accuracy or integrity of the information linked or displayed from these sources.