CVE-2021-42063

published 2021-12-14

CVE-2021-42063: A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50. The usage of one SAP KW component within a Web…

Priority P1 81 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

ITW EXPLOIT VulnCheck KEV

A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50. The usage of one SAP KW component within a Web browser enables unauthorized attackers to conduct XSS attacks, which might lead to disclose sensitive data.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
sap	knowledge_warehouse	—	—
sap	knowledge_warehouse	—	—
sap	knowledge_warehouse	—	—
sap	knowledge_warehouse	—	—
sap_se	sap_knowledge_warehouse	< 7.30	7.30
sap_se	sap_knowledge_warehouse	< 7.31	7.31
sap_se	sap_knowledge_warehouse	< 7.40	7.40
sap_se	sap_knowledge_warehouse	< 7.50	7.50

Detection & IOCs extracted from sources · hover to see the quote

url /SAPIrExtHelp/random/SAPIrExtHelp/random/%22%3e%3c%53%56%47%20%4f%4e%4c%4f%41%44%3d%26%23%39%37%26%23%31%30%38%26%23%31%30%31%26%23%31%31%34%26%23%31%31%36%28%26%23%78%36%34%26%23%78%36%66%26%23%78%36%33%26%23%78%37%35%26%23%78%36%64%26%23%78%36%35%26%23%78%36%65%26%23%78%37%34%26%23%78%32%65%26%23%78%36%34%26%23%78%36%66%26%23%78%36%64%26%23%78%36%31%26%23%78%36%39%26%23%78%36%65%29%3e.asp↗

other http.favicon.hash:-266008933↗

other icon_hash=-266008933↗

path /SAPIrExtHelp/↗

• → Response body must contain both the XSS payload string and the string 'SAPIKS2' to confirm exploitation of the reflected XSS endpoint. ↗
• → Response Content-Type header must be 'text/html' to confirm the vulnerable endpoint is rendering HTML (and thus the XSS payload). ↗
• → Use Shodan favicon hash -266008933 to identify internet-exposed SAP Knowledge Warehouse / SAP NetWeaver instances as potential targets. ↗
• → Use FOFA icon_hash=-266008933 or ZoomEye app="SAP NetWeaver Application Server httpd" to identify exposed SAP KW instances. ↗
• → The XSS attack is delivered via a GET request to the /SAPIrExtHelp/ path with a URL-encoded SVG ONLOAD payload injected into the path segment, requiring no authentication (PR:N). ↗

• · Vulnerable versions are SAP Knowledge Warehouse 7.30, 7.31, 7.40, and 7.50 only. The nuclei template targets these versions; scanning other SAP products on the same host may produce false positives. ↗
• · The detection requires UI interaction (UI:R per CVSS), meaning the XSS payload must be rendered in a victim's browser; server-side scanning alone confirms reflectivity but not full exploitation. ↗

CVSS provenance

nvd v3.1 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

nvd v2.0 4.3 MEDIUM AV:N/AC:M/Au:N/C:N/I:P/A:N

vulncheck 6.1 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79