CVE-2021-33702: sap_se sap netweaver enterprise portal Cross-site Scripting
Vulnerability summary
CVE-2021-33702 is a high (CVSS 8.3) Cross-site Scripting vulnerability in sap_se sap netweaver enterprise portal. EPSS estimates a 1.48% chance of exploitation in the next 30 days, higher than 73.7% of scored vulnerabilities.
Timeline
- 10-08-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
Under certain conditions, NetWeaver Enterprise Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode report data. An attacker can craft malicious data and print it to the report. In a successful attack, a victim opens the report, and the malicious script gets executed in the victim's browser, resulting in a Stored Cross-Site Scripting (XSS) vulnerability.
CVSS metrics
4 scores · 2 sources · 3 versions- NVDNIST8.3HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS trend
Probability
1.48%
Chance of exploitation in the next 30 days
Percentile
74%
Versus all other CVEs
30-day change
0.00 pp
From 1.48% on 22-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Sap1 product
- netweaver_enterprise_portal7.10 | 7.11 | 7.20 | 7.30 | 7.31 | 7.40 | 7.50
Sap_se1 product
- sap netweaver enterprise portal< 7.10 | < 7.11 | < 7.20 | < 7.30 | < 7.31 | < 7.40 | < 7.50
2 vendors · 2 products