TI-2021-15861 Aliases CVE-2021-38183 GHSA-f9gf-3986-8cqm

Cross-site scripting in SAP NetWeaver

LOW 29CWE-79Published 2021-10-12 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

SAP NetWeaver - versions 700, 701, 702, 730, does not sufficiently encode user-controlled inputs, allowing an attacker to cause a potential victim to supply a malicious content to a vulnerable web application, which is then reflected to the victim and executed by the web browser, resulting in Cross-Site Scripting vulnerability.

Why it matters now

EPSS 0.00747 55th percentileScored 2026-11-07

Fix Fixed SAP NetWeaver (SAP SE): 700, 701, 702 +1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP NetWeaver	before 700; before 701; before 702; before 730	700, 701, 702, 730	Patch available	CNA

SAP NetWeaver VendorSAP Affected before 700; before 701; before 702; before 730 Fixed in 700, 701, 702, 730 Patch available CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:netweaver:700:::::::*	700	Vulnerable	SAP
cpe:2.3:a:sap:netweaver:701:::::::*	701	Vulnerable	SAP
cpe:2.3:a:sap:netweaver:702:::::::*	702	Vulnerable	SAP
cpe:2.3:a:sap:netweaver:730:::::::*	730	Vulnerable	SAP

cpe:2.3:a:sap:netweaver:700:*:*:*:*:*:*:* Versions 700 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver:701:*:*:*:*:*:*:* Versions 701 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver:702:*:*:*:*:*:*:* Versions 702 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver:730:*:*:*:*:*:*:* Versions 730 Vulnerable ·SAP

Remediation

Fix · CNA SAP NetWeaver (SAP SE) Fixed in 700, 701, 702, 730

Timeline

2026-10-02 Threatist record created from CVE-2021-38183
2026-10-03 Alias added: GHSA-f9gf-3986-8cqm

References

Advisory 1

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983

Other 1

https://launchpad.support.sap.com/#/notes/3084937

TI-2025-22522 Missing Authorization check in SAP NetWeaver (Visual Composer development server) KEVCVSS 3.1CRITICAL 10.0
TI-2021-15842 Path traversal in SAP NetWeaver KEVCVSS 3.1CRITICAL 9.9
TI-2025-27866 Insecure Deserialization in SAP NetWeaver (Visual Composer development server) KEVCVSS 3.1CRITICAL 9.1
TI-2012-02262 The DiagTraceR3Info function in the Dialog processor in disp+work.exe 7010.29.15.58313… CVSS 2.0HIGH 9.3
TI-2013-01399 A Buffer Overflow vulnerability exists in the Message Server service… CVSS 3.1CRITICAL 9.8
TI-2016-02149 Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing… CVSS 3.0HIGH 7.5

See all 101 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences