« Volver al listado

CVE-2021-21476

Estado: ModificadaMedia (6.1)—

SAP UI5 versions before 1.38.49, 1.52.49, 1.60.34, 1.71.31, 1.78.18, 1.84.5, 1.85.4, 1.86.1 allows an unauthenticated attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — UI5

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-21476",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 4.7,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAP UI5",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.38.49"
            },
            {
              "status": "affected",
              "version": "< 1.52.49"
            },
            {
              "status": "affected",
              "version": "< 1.60.34"
            },
            {
              "status": "affected",
              "version": "< 1.71.31"
            },
            {
              "status": "affected",
              "version": "< 1.78.18"
            },
            {
              "status": "affected",
              "version": "< 1.84.5"
            },
            {
              "status": "affected",
              "version": "< 1.85.4"
            },
            {
              "status": "affected",
              "version": "< 1.86.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-02-09T21:15:13.533",
  "references": [
    {
      "url": "https://launchpad.support.sap.com/#/notes/3014303",
      "tags": [
        "Permissions Required",
        "Third Party Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/3014303",
      "tags": [
        "Permissions Required",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP UI5 versions before 1.38.49, 1.52.49, 1.60.34, 1.71.31, 1.78.18, 1.84.5, 1.85.4, 1.86.1 allows an unauthenticated attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities."
    },
    {
      "lang": "es",
      "value": "SAP UI5, versiones anteriores a: 1.38.49, 1.52.49, 1.60.34, 1.71.31, 1.78.18, 1.84.5, 1.85.4, 1.86.1, permite a un atacante no autenticado redireccionar a usuarios a un sitio malicioso debido a vulnerabilidades de tipo Tabnabbing Inverso"
    }
  ],
  "lastModified": "2026-06-17T03:35:38.847",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:ui5:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A6980394-2B06-4660-B495-E81FF13058CA",
              "versionEndExcluding": "1.38.49"
            },
            {
              "criteria": "cpe:2.3:a:sap:ui5:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4FE5AAFE-6AFB-4F3C-9919-650611936BD7",
              "versionEndExcluding": "1.52.49",
              "versionStartIncluding": "1.50.5"
            },
            {
              "criteria": "cpe:2.3:a:sap:ui5:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F88A1AE9-FF5E-4842-9C0E-A6C3DBB79CE6",
              "versionEndExcluding": "1.60.34",
              "versionStartIncluding": "1.60.1"
            },
            {
              "criteria": "cpe:2.3:a:sap:ui5:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1A1646B5-02CE-480C-91CC-D9F7FD48AB0D",
              "versionEndExcluding": "1.71.31",
              "versionStartIncluding": "1.71.0"
            },
            {
              "criteria": "cpe:2.3:a:sap:ui5:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "53D55323-DA22-4D9A-9D9D-4372A86BEF65",
              "versionEndExcluding": "1.78.18",
              "versionStartIncluding": "1.78.0"
            },
            {
              "criteria": "cpe:2.3:a:sap:ui5:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4BD70F05-C64D-4F82-A7AB-D512720211F2",
              "versionEndExcluding": "1.84.5",
              "versionStartIncluding": "1.84.0"
            },
            {
              "criteria": "cpe:2.3:a:sap:ui5:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "06FE28A7-74C3-4976-8CA7-FE446F85CD84",
              "versionEndExcluding": "1.85.4",
              "versionStartIncluding": "1.85.0"
            },
            {
              "criteria": "cpe:2.3:a:sap:ui5:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5D89B55D-5557-44B8-A80C-212135299C08",
              "versionEndExcluding": "1.86.1",
              "versionStartIncluding": "1.86.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}