CVE-2021-27601

State: Published
Severity: 5.4 Medium
Published: Apr 13, 2021
Updated: Aug 3, 2024
Reserved: Feb 23, 2021

Description

SAP NetWeaver AS Java (Applications based on HTMLB for Java) allows a basic-level authorized attacker to store a malicious file on the server. When a victim tries to open this file, it results in a Cross-Site Scripting (XSS) vulnerability and the attacker can read and modify data. However, the attacker does not have control over kind or degree.

Scores

CVSS	Score	Vector	Source
3.0	5.4 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	sap

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
SAP NetWeaver AS for Java (Applications based on HTMLB for Java)SAP SE	EP-BASIS 7.10, 7.11, 7.30, 7.31, 7.40, 7.50Affected FRAMEWORK-EXT 7.30, 7.31, 7.40, 7.50Affected FRAMEWORK 7.10, 7.11Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.