CVE-2021-33671: sap se sap netweaver guided procedures (administration workset) Missing Authorization
Vulnerability summary
CVE-2021-33671 is a high (CVSS 8.8) Missing Authorization vulnerability in sap se sap netweaver guided procedures (administration workset). EPSS estimates a 0.73% chance of exploitation in the next 30 days, higher than 53.7% of scored vulnerabilities.
Timeline
- 14-07-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
SAP NetWeaver Guided Procedures (Administration Workset), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. The impact of missing authorization could result to abuse of functionality restricted to a particular user group, and could allow unauthorized users to read, modify or delete restricted data.
CVSS metrics
4 scores · 2 sources · 3 versions- NVDNIST7.6HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
EPSS trend
Probability
0.73%
Chance of exploitation in the next 30 days
Percentile
54%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.73% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Sap1 product
- netweaver_guided_procedures7.10 | 7.20 | 7.30 | 7.31 | 7.40 | 7.50
Sap se1 product
- sap netweaver guided procedures (administration workset)< 7.10 | < 7.20 | < 7.30 | < 7.31 | < 7.40 | < 7.50
2 vendors · 2 products