CVE-2021-33670

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

SAP NetWeaver AS for Java (Http Service Monitoring Filter), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send multiple HTTP requests with different method types thereby crashing the filter and making the HTTP server unavailable to other legitimate users leading to denial of service vulnerability.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

Vendor	Product	Versions
SAP SE	SAP NetWeaver AS for Java (Http Service)	< 7.10; < 7.11; < 7.20; < 7.30; < 7.31; < 7.40; < 7.50

References

http://packetstormsecurity.com/files/166965/SAP-NetWeaver-Java-Denial-Of-Service.htmlPatch, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2022/May/4Mailing List, Patch, Third Party Advisory
https://launchpad.support.sap.com/#/notes/3056652Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506Vendor Advisory
http://packetstormsecurity.com/files/166965/SAP-NetWeaver-Java-Denial-Of-Service.htmlPatch, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2022/May/4Mailing List, Patch, Third Party Advisory
https://launchpad.support.sap.com/#/notes/3056652Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506Vendor Advisory

Timeline

Published: Jul 14, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-336718.8SAP NetWeaver Guided Procedures (Administration Workset), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary authoriz CVE-2021-336729.6Due to missing encoding in SAP Contact Center's Communication Desktop component- version 700, an attacker could send malicious script in cha CVE-2021-336736.1Under certain conditions, SAP Contact Center - version 700,does not sufficiently encode user-controlled inputs and persists in them. This al CVE-2021-336746.1Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs. This allows an attacker to CVE-2021-336756.1Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs. This allows an attacker to CVE-2021-336767.2A missing authority check in SAP CRM, versions - 700, 701, 702, 712, 713, 714, could be leveraged by an attacker with high privileges to com CVE-2021-336777.5SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 702, 730, 731, 804, 740, 750, 784, expose functions to external which can lead CVE-2021-336786.5A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A CVE-2021-336795.4The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to inject a malicious script CVE-2021-336806.5SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which causes buffer CVE-2021-336816.5SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which causes out of CVE-2021-336825.4SAP Lumira Server version 2.4 does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Th