CVE-2021-33702

Under certain conditions, NetWeaver Enterprise Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode report data. An attacker can craft malicious data and print it to the report. In a successful attack, a victim opens the report, and the malicious script gets executed in the victim's browser, resulting in a Stored Cross-Site Scripting (XSS) vulnerability.

• CWE-79
• CWE-79

• http://packetstormsecurity.com/files/165737/SAP-Enterprise-Portal-NavigationReporter-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/Jan/70Mailing List, Third Party Advisory
• https://launchpad.support.sap.com/#/notes/3073681Permissions Required, Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806Vendor Advisory
• http://packetstormsecurity.com/files/165737/SAP-Enterprise-Portal-NavigationReporter-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/Jan/70Mailing List, Third Party Advisory
• https://launchpad.support.sap.com/#/notes/3073681Permissions Required, Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806Vendor Advisory

Published

Aug 10, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33697Under certain conditions, SAP BusinessObjects Business Intel…6.1
• CVE-2021-33698SAP Business One, version - 10.0, allows an attacker with bu…8.8
• CVE-2021-33699Task Hijacking is a vulnerability that affects the applicati…6.5
• CVE-2021-3370DouPHP v1.6 was discovered to contain a cross-site scripting…6.1
• CVE-2021-33700SAP Business One, version - 10.0, allows a local attacker wi…7.8
• CVE-2021-33701DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_6…9.1
• CVE-2021-33703Under certain conditions, NetWeaver Enterprise Portal, versi…6.1
• CVE-2021-33704The Service Layer of SAP Business One, version - 10.0, allow…8.8
• CVE-2021-33705The SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30,…8.1
• CVE-2021-33706Due to improper input validation in InfraBox, logs can be mo…4.3
• CVE-2021-33707SAP NetWeaver Knowledge Management allows remote attackers t…6.1
• CVE-2021-33708Due to insufficient input validation in Kyma, authenticated …8.8