CVE-2021-33707 — Open Redirect in SE SAP Netweaver

CWE-601 — Open Redirect3 documents3 sources
Severity
6.1MEDIUMNVD
EPSS
0.6%
top 30.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
SAP SE SAP NetweaverSAP Netweaver Knowledge Management
Timeline
PublishedAug 10
Latest updateMay 24

Description

SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL stored in a component. This could enable the attacker to compromise the user's confidentiality and integrity.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5sap_se/sap_netweaver< 7.30+3

🔴Vulnerability Details

2
GHSA
GHSA-7fm7-3fm9-2j98: SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL stored in a↗2022-05-24
▶
CVEList
CVE-2021-33707: SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL stored in a↗2021-08-10
▶
CVE-2021-33707 — Open Redirect in SAP SE SAP Netweaver | cvebase