CVE-2021-33687

SAP NetWeaver AS JAVA (Enterprise Portal), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 reveals sensitive information in one of their HTTP requests, an attacker can use this in conjunction with other attacks such as XSS to steal this information.

• CWE-200

• http://packetstormsecurity.com/files/164600/SAP-Enterprise-Portal-Sensitive-Data-Disclosure.htmlPatch, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2021/Oct/32Mailing List, Patch, Third Party Advisory
• https://launchpad.support.sap.com/#/notes/3059764Permissions Required
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506Vendor Advisory
• http://packetstormsecurity.com/files/164600/SAP-Enterprise-Portal-Sensitive-Data-Disclosure.htmlPatch, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2021/Oct/32Mailing List, Patch, Third Party Advisory
• https://launchpad.support.sap.com/#/notes/3059764Permissions Required
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506Vendor Advisory

Published

Jul 14, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33681SAP 3D Visual Enterprise Viewer, version - 9, allows a user …6.5
• CVE-2021-33682SAP Lumira Server version 2.4 does not sufficiently encode u…5.4
• CVE-2021-33683SAP Web Dispatcher and Internet Communication Manager (ICM),…4.3
• CVE-2021-33684SAP NetWeaver AS ABAP and ABAP Platform, versions - KRNL32NU…5.3
• CVE-2021-33685SAP Business One version - 10.0 allows low-level authorized …6.5
• CVE-2021-33686Under certain conditions, SAP Business One version - 10.0, a…5.3
• CVE-2021-33688SAP Business One allows an attacker with business privileges…4.3
• CVE-2021-33689When user with insufficient privileges tries to access any a…4.3
• CVE-2021-33690Server-Side Request Forgery (SSRF) vulnerability has been de…9.9
• CVE-2021-33691NWDI Notification Service versions - 7.31, 7.40, 7.50, does …6.1
• CVE-2021-33692SAP Cloud Connector, version - 2.0, allows the upload of zip…7.5
• CVE-2021-33693SAP Cloud Connector, version - 2.0, allows an authenticated …6.8