cbcvebase.
CVE-2021-21476
published 2021-02-09

CVE-2021-21476: SAP UI5 versions before 1.38.49, 1.52.49, 1.60.34, 1.71.31, 1.78.18, 1.84.5, 1.85.4, 1.86.1 allows an unauthenticated attacker to redirect users to a malicious…

PriorityP428medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.82%
52.9th percentile
SAP UI5 versions before 1.38.49, 1.52.49, 1.60.34, 1.71.31, 1.78.18, 1.84.5, 1.85.4, 1.86.1 allows an unauthenticated attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities.

Affected

16 ranges
VendorProductVersion rangeFixed in
sapui5< 1.38.491.38.49
sapui5>= 1.50.5 < 1.52.491.52.49
sapui5>= 1.60.1 < 1.60.341.60.34
sapui5>= 1.71.0 < 1.71.311.71.31
sapui5>= 1.78.0 < 1.78.181.78.18
sapui5>= 1.84.0 < 1.84.51.84.5
sapui5>= 1.85.0 < 1.85.41.85.4
sapui5>= 1.86.0 < 1.86.11.86.1
sap_sesap_ui5< 1.38.491.38.49
sap_sesap_ui5< 1.52.491.52.49
sap_sesap_ui5< 1.60.341.60.34
sap_sesap_ui5< 1.71.311.71.31
sap_sesap_ui5< 1.78.181.78.18
sap_sesap_ui5< 1.84.51.84.5
sap_sesap_ui5< 1.85.41.85.4
sap_sesap_ui5< 1.86.11.86.1

CVSS provenance

nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv3.04.7MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.