CVE-2021-33670
Vulnerability from cvelistv5
Published
2021-07-14 11:04
Modified
2024-08-03 23:58
Severity ?
EPSS score ?
Summary
SAP NetWeaver AS for Java (Http Service Monitoring Filter), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send multiple HTTP requests with different method types thereby crashing the filter and making the HTTP server unavailable to other legitimate users leading to denial of service vulnerability.
References
▼ | URL | Tags | |
---|---|---|---|
cna@sap.com | http://packetstormsecurity.com/files/166965/SAP-NetWeaver-Java-Denial-Of-Service.html | Patch, Third Party Advisory, VDB Entry | |
cna@sap.com | http://seclists.org/fulldisclosure/2022/May/4 | Mailing List, Patch, Third Party Advisory | |
cna@sap.com | https://launchpad.support.sap.com/#/notes/3056652 | Permissions Required | |
cna@sap.com | https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 | Vendor Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/166965/SAP-NetWeaver-Java-Denial-Of-Service.html | Patch, Third Party Advisory, VDB Entry | |
af854a3a-2127-422b-91ae-364da2661108 | http://seclists.org/fulldisclosure/2022/May/4 | Mailing List, Patch, Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://launchpad.support.sap.com/#/notes/3056652 | Permissions Required | |
af854a3a-2127-422b-91ae-364da2661108 | https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 | Vendor Advisory |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
▼ | SAP SE | SAP NetWeaver AS for Java (Http Service) |
Version: < 7.10 Version: < 7.11 Version: < 7.20 Version: < 7.30 Version: < 7.31 Version: < 7.40 Version: < 7.50 |
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-03T23:58:22.541Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://launchpad.support.sap.com/#/notes/3056652" }, { "name": "20220504 Onapsis Security Advisory 2022-0002: Denial of Service in SAP NetWeaver JAVA", "tags": [ "mailing-list", "x_refsource_FULLDISC", "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2022/May/4" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "http://packetstormsecurity.com/files/166965/SAP-NetWeaver-Java-Denial-Of-Service.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "SAP NetWeaver AS for Java (Http Service)", "vendor": "SAP SE", "versions": [ { "status": "affected", "version": "\u003c 7.10" }, { "status": "affected", "version": "\u003c 7.11" }, { "status": "affected", "version": "\u003c 7.20" }, { "status": "affected", "version": "\u003c 7.30" }, { "status": "affected", "version": "\u003c 7.31" }, { "status": "affected", "version": "\u003c 7.40" }, { "status": "affected", "version": "\u003c 7.50" } ] } ], "descriptions": [ { "lang": "en", "value": "SAP NetWeaver AS for Java (Http Service Monitoring Filter), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send multiple HTTP requests with different method types thereby crashing the filter and making the HTTP server unavailable to other legitimate users leading to denial of service vulnerability." } ], "metrics": [ { "cvssV3_0": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" } } ], "problemTypes": [ { "descriptions": [ { "description": "Denial of Service", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2022-05-04T23:06:09", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506" }, { "tags": [ "x_refsource_MISC" ], "url": "https://launchpad.support.sap.com/#/notes/3056652" }, { "name": "20220504 Onapsis Security Advisory 2022-0002: Denial of Service in SAP NetWeaver JAVA", "tags": [ "mailing-list", "x_refsource_FULLDISC" ], "url": "http://seclists.org/fulldisclosure/2022/May/4" }, { "tags": [ "x_refsource_MISC" ], "url": "http://packetstormsecurity.com/files/166965/SAP-NetWeaver-Java-Denial-Of-Service.html" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cna@sap.com", "ID": "CVE-2021-33670", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "SAP NetWeaver AS for Java (Http Service)", "version": { "version_data": [ { "version_name": "\u003c", "version_value": "7.10" }, { "version_name": "\u003c", "version_value": "7.11" }, { "version_name": "\u003c", "version_value": "7.20" }, { "version_name": "\u003c", "version_value": "7.30" }, { "version_name": "\u003c", "version_value": "7.31" }, { "version_name": "\u003c", "version_value": "7.40" }, { "version_name": "\u003c", "version_value": "7.50" } ] } } ] }, "vendor_name": "SAP SE" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "SAP NetWeaver AS for Java (Http Service Monitoring Filter), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send multiple HTTP requests with different method types thereby crashing the filter and making the HTTP server unavailable to other legitimate users leading to denial of service vulnerability." } ] }, "impact": { "cvss": { "baseScore": "7.5", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Denial of Service" } ] } ] }, "references": { "reference_data": [ { "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506", "refsource": "MISC", "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506" }, { "name": "https://launchpad.support.sap.com/#/notes/3056652", "refsource": "MISC", "url": "https://launchpad.support.sap.com/#/notes/3056652" }, { "name": "20220504 Onapsis Security Advisory 2022-0002: Denial of Service in SAP NetWeaver JAVA", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2022/May/4" }, { "name": "http://packetstormsecurity.com/files/166965/SAP-NetWeaver-Java-Denial-Of-Service.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/166965/SAP-NetWeaver-Java-Denial-Of-Service.html" } ] } } } }, "cveMetadata": { "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2021-33670", "datePublished": "2021-07-14T11:04:11", "dateReserved": "2021-05-28T00:00:00", "dateUpdated": "2024-08-03T23:58:22.541Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "fkie_nvd": { "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:netweaver_application_server_java:7.10:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D60371A7-F8F4-46F8-9659-DD4EE84B81EA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:netweaver_application_server_java:7.11:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C6B085AF-8CEE-4A87-B381-F36C989FB2A0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:netweaver_application_server_java:7.20:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"43A28C48-4325-4694-88B1-FEE46EBFB0A6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:netweaver_application_server_java:7.30:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"24A1E0B9-8C28-41BC-B050-237B5F929C9C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:netweaver_application_server_java:7.31:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EEAE6C2A-821F-4123-BD56-0FDADF9D63C8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:netweaver_application_server_java:7.40:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F5308FCE-8B2C-4B4D-BEE7-3CF544570B68\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:netweaver_application_server_java:7.50:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9C506445-3787-4BFF-A98B-7502A0F7CF80\"}]}]}]", "descriptions": "[{\"lang\": \"en\", \"value\": \"SAP NetWeaver AS for Java (Http Service Monitoring Filter), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send multiple HTTP requests with different method types thereby crashing the filter and making the HTTP server unavailable to other legitimate users leading to denial of service vulnerability.\"}, {\"lang\": \"es\", \"value\": \"SAP NetWeaver AS for Java (Http Service Monitoring Filter), versiones - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, permite a un atacante enviar m\\u00faltiples peticiones HTTP con diferentes tipos de m\\u00e9todos, bloqueando as\\u00ed el filtro y haciendo que el servidor HTTP no est\\u00e9 disponible para otros usuarios leg\\u00edtimos, conllevando a una vulnerabilidad denegaci\\u00f3n de servicio\"}]", "id": "CVE-2021-33670", "lastModified": "2024-11-21T06:09:19.560", "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}], \"cvssMetricV30\": [{\"source\": \"cna@sap.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:N/I:N/A:P\", \"baseScore\": 5.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 10.0, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}", "published": "2021-07-14T12:15:08.243", "references": "[{\"url\": \"http://packetstormsecurity.com/files/166965/SAP-NetWeaver-Java-Denial-Of-Service.html\", \"source\": \"cna@sap.com\", \"tags\": [\"Patch\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://seclists.org/fulldisclosure/2022/May/4\", \"source\": \"cna@sap.com\", \"tags\": [\"Mailing List\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://launchpad.support.sap.com/#/notes/3056652\", \"source\": \"cna@sap.com\", \"tags\": [\"Permissions Required\"]}, {\"url\": \"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506\", \"source\": \"cna@sap.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://packetstormsecurity.com/files/166965/SAP-NetWeaver-Java-Denial-Of-Service.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://seclists.org/fulldisclosure/2022/May/4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://launchpad.support.sap.com/#/notes/3056652\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Permissions Required\"]}, {\"url\": \"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]", "sourceIdentifier": "cna@sap.com", "vulnStatus": "Modified", "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]" }, "nvd": "{\"cve\":{\"id\":\"CVE-2021-33670\",\"sourceIdentifier\":\"cna@sap.com\",\"published\":\"2021-07-14T12:15:08.243\",\"lastModified\":\"2024-11-21T06:09:19.560\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"SAP NetWeaver AS for Java (Http Service Monitoring Filter), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send multiple HTTP requests with different method types thereby crashing the filter and making the HTTP server unavailable to other legitimate users leading to denial of service vulnerability.\"},{\"lang\":\"es\",\"value\":\"SAP NetWeaver AS for Java (Http Service Monitoring Filter), versiones - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, permite a un atacante enviar m\u00faltiples peticiones HTTP con diferentes tipos de m\u00e9todos, bloqueando as\u00ed el filtro y haciendo que el servidor HTTP no est\u00e9 disponible para otros usuarios leg\u00edtimos, conllevando a una vulnerabilidad denegaci\u00f3n de servicio\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV30\":[{\"source\":\"cna@sap.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:N/A:P\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_application_server_java:7.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D60371A7-F8F4-46F8-9659-DD4EE84B81EA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_application_server_java:7.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C6B085AF-8CEE-4A87-B381-F36C989FB2A0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_application_server_java:7.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"43A28C48-4325-4694-88B1-FEE46EBFB0A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_application_server_java:7.30:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"24A1E0B9-8C28-41BC-B050-237B5F929C9C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_application_server_java:7.31:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EEAE6C2A-821F-4123-BD56-0FDADF9D63C8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_application_server_java:7.40:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F5308FCE-8B2C-4B4D-BEE7-3CF544570B68\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:netweaver_application_server_java:7.50:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9C506445-3787-4BFF-A98B-7502A0F7CF80\"}]}]}],\"references\":[{\"url\":\"http://packetstormsecurity.com/files/166965/SAP-NetWeaver-Java-Denial-Of-Service.html\",\"source\":\"cna@sap.com\",\"tags\":[\"Patch\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://seclists.org/fulldisclosure/2022/May/4\",\"source\":\"cna@sap.com\",\"tags\":[\"Mailing List\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://launchpad.support.sap.com/#/notes/3056652\",\"source\":\"cna@sap.com\",\"tags\":[\"Permissions Required\"]},{\"url\":\"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506\",\"source\":\"cna@sap.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://packetstormsecurity.com/files/166965/SAP-NetWeaver-Java-Denial-Of-Service.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://seclists.org/fulldisclosure/2022/May/4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://launchpad.support.sap.com/#/notes/3056652\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Permissions Required\"]},{\"url\":\"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}" } }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.