CVE-2021-21491

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-03-10 · updated 2026-06-17
Weakness: CWE-601

Description

SAP Netweaver Application Server Java (Applications based on WebDynpro Java) versions 7.00, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allow an attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities.

Affected products

SAP NetWeaver AS Java: 7.00, 7.10, 7.11, 7.20, 7.30, 7.31 (+2)

References

https://launchpad.support.sap.com/#/notes/2976947
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107
https://launchpad.support.sap.com/#/notes/2976947
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107

Get alerted when CVE-2021-21491 or the next vulnerability affects your stack