CVE-2021-21492

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

SAP NetWeaver Application Server Java(HTTP Service), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate logon group in URLs, resulting in a content spoofing vulnerability when directory listing is enabled.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-290

Affected software

Vendor	Product	Versions
SAP SE	SAP NetWeaver AS for JAVA (HTTP Service)	< 7.10; < 7.11; < 7.20; < 7.30; < 7.31; < 7.40; < 7.50

References

https://launchpad.support.sap.com/#/notes/3025637Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649Vendor Advisory
https://launchpad.support.sap.com/#/notes/3025637Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649Vendor Advisory

Timeline

Published: Apr 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-214933.3When a user opens manipulated Graphics Interchange Format (.GIF) format files received from untrusted sources in SAP 3D Visual Enterprise Vi CVE-2021-214944.8MK-AUTH through 19.01 K4.9 allows XSS via the admin/logs_ajax.php tipo parameter. An attacker can leverage this to read the centralmka2 (ses CVE-2021-214958.8MK-AUTH through 19.01 K4.9 allows CSRF for password changes via the central/executar_central.php?acao=altsenha_princ URI.CVE-2021-21508.2Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Supported versions that are affected are 1 CVE-2021-215017.5Improper configuration will cause ServiceComb ServiceCenter Directory Traversal problem in ServcieCenter 1.x.x versions and fixed in 2.0.0.CVE-2021-215029.8Dell PowerScale OneFS versions 8.1.0 – 9.1.0 contain a "use of SSH key past account expiration" vulnerability. A user on the network with th CVE-2021-215037.8PowerScale OneFS 8.1.2,8.2.2 and 9.1.0 contains an improper input sanitization issue in a command. The Compadmin user could potentially expl CVE-2021-215059.8Dell EMC Integrated System for Microsoft Azure Stack Hub, versions 1906 – 2011, contain an undocumented default iDRAC account. A remote unau CVE-2021-215068.8PowerScale OneFS 8.1.2,8.2.2 and 9.1.0 contains an improper input sanitization issue in its API handler. An un-authtenticated with ISI_PRIV_CVE-2021-215079.8Dell EMC Networking X-Series firmware versions prior to 3.0.1.8 and Dell EMC PowerEdge VRTX Switch Module firmware versions prior to 2.0.0.8 CVE-2021-215086.7Dell VxRail versions before 7.0.200 contain a Plain-text Password Storage Vulnerability in VxRail Manager. A sys-admin user may exploit this CVE-2021-21516.7Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Supported versions that are affec