CVE-2021-21492
First published: Tue Apr 13 2021(Updated: )
SAP NetWeaver Application Server Java(HTTP Service), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate logon group in URLs, resulting in a content spoofing vulnerability when directory listing is enabled.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP NetWeaver Application Server Java | =7.10 | |
| SAP NetWeaver Application Server Java | =7.11 | |
| SAP NetWeaver Application Server Java | =7.20 | |
| SAP NetWeaver Application Server Java | =7.30 | |
| SAP NetWeaver Application Server Java | =7.31 | |
| SAP NetWeaver Application Server Java | =7.40 | |
| SAP NetWeaver Application Server Java | =7.50 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-21492?
The severity of CVE-2021-21492 is medium.
What is the vulnerability in SAP NetWeaver Application Server Java(HTTP Service) versions 7.10 7.11 7.20 7.30 7.31 7.40 7.50?
The vulnerability in these versions is a content spoofing vulnerability caused by insufficient validation of logon group in URLs when directory listing is enabled.
How does the content spoofing vulnerability in CVE-2021-21492 impact SAP NetWeaver Application Server Java(HTTP Service)?
The content spoofing vulnerability in CVE-2021-21492 allows an attacker to manipulate the content displayed on the affected server.
How can I fix the content spoofing vulnerability in SAP NetWeaver Application Server Java(HTTP Service) versions 7.10 7.11 7.20 7.30 7.31 7.40 7.50?
To fix the vulnerability, update SAP NetWeaver Application Server Java to a patched version provided by SAP.
Where can I find more information about CVE-2021-21492?
You can find more information about CVE-2021-21492 in the SAP support portal and the SAP community wiki.
- collector/nvd-index
- agent/weakness
- agent/references
- agent/author
- agent/severity
- agent/type
- agent/event
- agent/description
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/sap
- canonical/sap netweaver application server java
- version/sap netweaver application server java/7.10
- version/sap netweaver application server java/7.11
- version/sap netweaver application server java/7.20
- version/sap netweaver application server java/7.30
- version/sap netweaver application server java/7.31
- version/sap netweaver application server java/7.40
- version/sap netweaver application server java/7.50