Back to Database
Status published
Medium
CVE-2021-21492
SAP NetWeaver Application Server Java(HTTP Service), versions - 7.10, 7.11,...
Vulnerability Description
SAP NetWeaver Application Server Java(HTTP Service), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate logon group in URLs, resulting in a content spoofing vulnerability when directory listing is enabled.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-21492
Credits & Attribution
No credits recorded in the NVD database.
References
More from SAP SE
View All →CVE-2025-42956
Multiple vulnerabilities in SAP NetWeaver Application Server ABAP
Medium
6.1
CVE-2023-40307
Privileges Memory Corruption (Out-of-bound write)
Medium
6.3
CVE-2023-40306
URL Redirection vulnerability in SAP S/4HANA (Manage Catalog Items and Cross-Catalog search)
Medium
6.1
CVE-2023-36920
Clickjacking vulnerability in SAP Enable Now
Medium
6.1
CVE-2022-41260
SAP Financial Consolidation - version 1010, does not sufficiently encode...
Medium
6.1
Affected Vendor
SAP SE
View all reports →Affected Software
SAP NetWeaver AS for JAVA (HTTP Service)
Vulnerable Versions:
< 7.10, < 7.11, < 7.20, < 7.30, < 7.31, < 7.40, < 7.50
Timeline
Official Publish:
April 13th, 2021
Last Modified:
August 3rd, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N