CVE-2021-33707

SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL stored in a component. This could enable the attacker to compromise the user's confidentiality and integrity.

• CWE-601
• CWE-601

• http://packetstormsecurity.com/files/165748/SAP-Enterprise-Portal-Open-Redirect.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/Jan/73Mailing List, Mitigation, Third Party Advisory
• https://launchpad.support.sap.com/#/notes/3076399Permissions Required, Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806Vendor Advisory
• http://packetstormsecurity.com/files/165748/SAP-Enterprise-Portal-Open-Redirect.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/Jan/73Mailing List, Mitigation, Third Party Advisory
• https://launchpad.support.sap.com/#/notes/3076399Permissions Required, Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806Vendor Advisory

Published

Aug 10, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33701DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_6…9.1
• CVE-2021-33702Under certain conditions, NetWeaver Enterprise Portal, versi…6.1
• CVE-2021-33703Under certain conditions, NetWeaver Enterprise Portal, versi…6.1
• CVE-2021-33704The Service Layer of SAP Business One, version - 10.0, allow…8.8
• CVE-2021-33705The SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30,…8.1
• CVE-2021-33706Due to improper input validation in InfraBox, logs can be mo…4.3
• CVE-2021-33708Due to insufficient input validation in Kyma, authenticated …8.8
• CVE-2021-33709A vulnerability has been identified in Teamcenter Active Wor…4.3
• CVE-2021-33710A vulnerability has been identified in Teamcenter Active Wor…6.1
• CVE-2021-33711A vulnerability has been identified in Teamcenter Active Wor…5.3
• CVE-2021-33712A vulnerability has been identified in Mendix SAML Module (A…8.8
• CVE-2021-33713A vulnerability has been identified in JT Utilities (All ver…5.5