CVE-2021-33705 Server-side request forgery in SAP NetWeaver Enterprise Portal
An unauthenticated attacker can exploit an SSRF vulnerability in the Iviews Editor to access or modify internal data via crafted URLs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-33705?
CVE-2021-33705 is a high-severity server-side request forgery vulnerability in SAP NetWeaver Enterprise Portal, published on 15 Sep 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, component Iviews Editor contains a Server-Side Request Forgery (SSRF) vulnerability which allows an unauthenticated attacker to craft a malicious URL which when clicked by a user can make any type of request (e.g. POST, GET) to any internal or external server. This can result in the accessing or modification of data accessible from the Portal but will not affect its availability.
Weakness: CWE-918
Which versions are affected by CVE-2021-33705?
It affects 1 product.
Products include Sap Netweaver Portal.
How do I fix CVE-2021-33705?
No fix has been published for CVE-2021-33705 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2021-33705 being exploited?
There is no known exploitation of CVE-2021-33705 in the wild and no public exploit code.
Other vulnerabilities in SAP NetWeaver Enterprise Portal
Sources
Also known as GHSA-rwjf-4f53-289h.