CVE-2021-33705

The SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, component Iviews Editor contains a Server-Side Request Forgery (SSRF) vulnerability which allows an unauthenticated attacker to craft a malicious URL which when clicked by a user can make any type of request (e.g. POST, GET) to any internal or external server. This can result in the accessing or modification of data accessible from the Portal but will not affect its availability.

• CWE-918
• CWE-918

• http://packetstormsecurity.com/files/165743/SAP-Enterprise-Portal-iviewCatcherEditor-Server-Side-Request-Forgery.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/Jan/72Mailing List, Third Party Advisory
• https://launchpad.support.sap.com/#/notes/3074844Permissions Required
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806Patch, Vendor Advisory
• http://packetstormsecurity.com/files/165743/SAP-Enterprise-Portal-iviewCatcherEditor-Server-Side-Request-Forgery.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/Jan/72Mailing List, Third Party Advisory
• https://launchpad.support.sap.com/#/notes/3074844Permissions Required
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806Patch, Vendor Advisory

Published

Sep 15, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3370DouPHP v1.6 was discovered to contain a cross-site scripting…6.1
• CVE-2021-33700SAP Business One, version - 10.0, allows a local attacker wi…7.8
• CVE-2021-33701DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_6…9.1
• CVE-2021-33702Under certain conditions, NetWeaver Enterprise Portal, versi…6.1
• CVE-2021-33703Under certain conditions, NetWeaver Enterprise Portal, versi…6.1
• CVE-2021-33704The Service Layer of SAP Business One, version - 10.0, allow…8.8
• CVE-2021-33706Due to improper input validation in InfraBox, logs can be mo…4.3
• CVE-2021-33707SAP NetWeaver Knowledge Management allows remote attackers t…6.1
• CVE-2021-33708Due to insufficient input validation in Kyma, authenticated …8.8
• CVE-2021-33709A vulnerability has been identified in Teamcenter Active Wor…4.3
• CVE-2021-33710A vulnerability has been identified in Teamcenter Active Wor…6.1
• CVE-2021-33711A vulnerability has been identified in Teamcenter Active Wor…5.3