CVE-2021-21490: XSS
Published Jun 9, 2021
·Updated
SAP NetWeaver AS for ABAP (Web Survey), versions - 700, 702, 710, 711, 730, 731, 750, 750, 752, 75A, 75F, does not sufficiently encode input and output parameters which results in reflected cross site scripting vulnerability, through which a malicious user can access data relating to the current session and use it to impersonate a user and access all information with the same rights as the target user.
Affected Software
10 affected components
SAP NetWeaver Application Server ABAP=75a
SAP NetWeaver Application Server ABAP=75f
SAP NetWeaver Application Server ABAP=700
SAP NetWeaver Application Server ABAP=702
SAP NetWeaver Application Server ABAP=710
SAP NetWeaver Application Server ABAP=711
SAP NetWeaver Application Server ABAP=730
SAP NetWeaver Application Server ABAP=731
SAP NetWeaver Application Server ABAP=750
SAP NetWeaver Application Server ABAP=752
Event History
Jun 9, 2021
CVE Published
via MITRE·01:23 PM
Data Sourced
via MITRE·01:23 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID of this SAP NetWeaver ABAP vulnerability?
The vulnerability ID is CVE-2021-21490.
2
What is the severity of CVE-2021-21490?
The severity of CVE-2021-21490 is medium.
3
Which SAP NetWeaver AS for ABAP versions are affected by CVE-2021-21490?
The affected versions are 700, 702, 710, 711, 730, 731, 750, 752, 75A, and 75F.
4
What is the CWE ID associated with CVE-2021-21490?
The CWE ID associated with CVE-2021-21490 is 79.
5
How can I fix the CVE-2021-21490 vulnerability?
To fix the CVE-2021-21490 vulnerability, apply the necessary patches and updates provided by SAP.