« Volver al listado

CVE-2021-27621

Estado: ModificadaMedia (4.9)—

Information Disclosure vulnerability in UserAdmin application in SAP NetWeaver Application Server for Java, versions - 7.11,7.20,7.30,7.31,7.40 and 7.50 allows attackers to access restricted information by entering malicious server name.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — Netweaver Application Server FOR Java

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-27621",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 5.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAP NetWeaver AS for Java (UserAdmin)",
          "versions": [
            {
              "status": "affected",
              "version": "< 7.11"
            },
            {
              "status": "affected",
              "version": "< 7.20"
            },
            {
              "status": "affected",
              "version": "< 7.30"
            },
            {
              "status": "affected",
              "version": "< 7.31"
            },
            {
              "status": "affected",
              "version": "< 7.40"
            },
            {
              "status": "affected",
              "version": "< 7.50"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-06-09T14:15:08.407",
  "references": [
    {
      "url": "https://launchpad.support.sap.com/#/notes/3023299",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/3023299",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Information Disclosure vulnerability in UserAdmin application in SAP NetWeaver Application Server for Java, versions - 7.11,7.20,7.30,7.31,7.40 and 7.50 allows attackers to access restricted information by entering malicious server name."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de divulgación de información en la aplicación UserAdmin en SAP NetWeaver Application Server para Java, versiones - 7.11,7.20,7.30,7.31,7.40 y 7.50, permite a atacantes acceder a información restringida al ingresar el nombre del servidor malicioso"
    }
  ],
  "lastModified": "2026-06-17T03:45:14.800",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_for_java:7.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "78E9E4CA-6FC4-4F6C-8828-27847FF4DA34"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_for_java:7.20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EFD1EA44-56EB-4666-B678-36E92C7CB818"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_for_java:7.30:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D840AE49-147F-4444-A12E-B8270741F0EB"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_for_java:7.31:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "54F3F9CD-A9D8-4678-8875-3F8A03001E06"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_for_java:7.40:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "17BD1158-48D2-4685-AAA8-AAC5E0BCF7EF"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_for_java:7.50:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D7A80232-F2C2-4B40-A00C-25611D3409AC"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}