CVE-2021-33707

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-08-10 · updated 2026-06-17
Weakness: CWE-601

Description

SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL stored in a component. This could enable the attacker to compromise the user's confidentiality and integrity.

Affected products

SAP SE SAP NetWeaver (Knowledge Management): 7.30, 7.31, 7.40, 7.50

References

http://packetstormsecurity.com/files/165748/SAP-Enterprise-Portal-Open-Redirect.html
http://seclists.org/fulldisclosure/2022/Jan/73
https://launchpad.support.sap.com/#/notes/3076399
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806
http://packetstormsecurity.com/files/165748/SAP-Enterprise-Portal-Open-Redirect.html
http://seclists.org/fulldisclosure/2022/Jan/73
https://launchpad.support.sap.com/#/notes/3076399
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806

Get alerted when CVE-2021-33707 or the next vulnerability affects your stack