Medium severity · published Feb 9, 2021
CVE-2021-21476
SAP UI5 versions before 1.38.49, 1.52.49, 1.60.34, 1.71.31, 1.78.18, 1.84.5, 1.85.4, 1.86.1 allows an unauthenticated attacker to redirect users to a malicious site due to Reverse…
6.1
CVSS
0.8%
EPSS
No
On KEV
Description
SAP UI5 versions before 1.38.49, 1.52.49, 1.60.34, 1.71.31, 1.78.18, 1.84.5, 1.85.4, 1.86.1 allows an unauthenticated attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UI
Ui5 · Sap
before 1.38.49; 1.50.5 before 1.52.49; 1.60.1 before 1.60.34; 1.71.0 before 1.71.31; 1.78.0 before 1.78.18; 1.84.0 before 1.84.5; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-21476
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-21476
Permissions Required
https://launchpad.support.sap.com/#/notes/3014303
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543
More from Ui5
7.5
CVE-2019-0319
The SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message
7.5
CVE-2018-2424
SAP UI5 did not validate user input before adding it to the DOM structure