CVE-2021-33690: SSRF
Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP NetWeaver Development Infrastructure Component Build Service allows a threat actor who has access to the server to perform proxy attacks on server by sending crafted queries. Due to this, the threat actor could completely compromise sensitive data residing on the Server and impact its availability.Note: The impact of this vulnerability depends on whether SAP NetWeaver Development Infrastructure (NWDI) runs on the intranet or internet. The CVSS score reflects the impact considering the worst-case scenario that it runs on the internet.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-33690?
CVE-2021-33690 has a high severity rating due to its potential for Server-Side Request Forgery (SSRF) exploitation.
How do I fix CVE-2021-33690?
To fix CVE-2021-33690, it is recommended to apply the latest security patches provided by SAP for affected versions.
Which versions are affected by CVE-2021-33690?
CVE-2021-33690 affects SAP NetWeaver Development Infrastructure versions 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50.
What are the potential impacts of exploiting CVE-2021-33690?
Exploiting CVE-2021-33690 could allow an attacker to send unauthorized requests to internal resources, leading to data exposure or further attacks.
Is CVE-2021-33690 a common vulnerability?
CVE-2021-33690 is a known vulnerability that has been identified in widely used SAP products, making it critical for organizations to address.