CVE-2021-33670
First published: Wed Jul 14 2021(Updated: )
SAP NetWeaver AS for Java (Http Service Monitoring Filter), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send multiple HTTP requests with different method types thereby crashing the filter and making the HTTP server unavailable to other legitimate users leading to denial of service vulnerability.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP NetWeaver Application Server Java | =7.10 | |
| SAP NetWeaver Application Server Java | =7.11 | |
| SAP NetWeaver Application Server Java | =7.20 | |
| SAP NetWeaver Application Server Java | =7.30 | |
| SAP NetWeaver Application Server Java | =7.31 | |
| SAP NetWeaver Application Server Java | =7.40 | |
| SAP NetWeaver Application Server Java | =7.50 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-33670.
What is the severity of CVE-2021-33670?
CVE-2021-33670 has a severity rating of 7.5, which is considered high.
Which versions of SAP NetWeaver AS for Java are affected?
Versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 of SAP NetWeaver AS for Java are affected.
How does CVE-2021-33670 impact the system?
CVE-2021-33670 allows an attacker to send multiple HTTP requests with different method types, crashing the filter and making the HTTP server unavailable to other legitimate users, leading to denial of service.
Is there a fix available for CVE-2021-33670?
Yes, SAP has released a security note (3056652) that provides fixes for CVE-2021-33670. It is recommended to apply the necessary patches or updates provided by SAP.
- collector/nvd-index
- agent/references
- agent/tags
- agent/event
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- vendor/sap
- canonical/sap netweaver application server java
- version/sap netweaver application server java/7.10
- version/sap netweaver application server java/7.11
- version/sap netweaver application server java/7.20
- version/sap netweaver application server java/7.30
- version/sap netweaver application server java/7.31
- version/sap netweaver application server java/7.40
- version/sap netweaver application server java/7.50