CVE-2021-21476 - OpenCVE

SAP UI5 versions before 1.38.49, 1.52.49, 1.60.34, 1.71.31, 1.78.18, 1.84.5, 1.85.4, 1.86.1 allows an unauthenticated attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:N/C:P/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Sap	Ui5

Configuration 1 [-]

OR	cpe:2.3:a:sap:ui5::::::::
	cpe:2.3:a:sap:ui5::::::::
	cpe:2.3:a:sap:ui5::::::::
	cpe:2.3:a:sap:ui5::::::::
	cpe:2.3:a:sap:ui5::::::::
	cpe:2.3:a:sap:ui5::::::::
	cpe:2.3:a:sap:ui5::::::::
	cpe:2.3:a:sap:ui5::::::::

No data.

References

Link	Providers
https://launchpad.support.sap.com/#/notes/3014303
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543

History

No history.

MITRE

Status: PUBLISHED

Assigner: sap

Published: 2021-02-09T20:44:32

Updated: 2024-08-03T18:16:22.644Z

Reserved: 2020-12-30T00:00:00

Link: CVE-2021-21476

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2021-02-09T21:15:13.533

Modified: 2021-04-01T12:47:52.530

Link: CVE-2021-21476

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "SAP UI5", "vendor": "SAP SE", "versions": [{"status": "affected", "version": "< 1.38.49"}, {"status": "affected", "version": "< 1.52.49"}, {"status": "affected", "version": "< 1.60.34"}, {"status": "affected", "version": "< 1.71.31"}, {"status": "affected", "version": "< 1.78.18"}, {"status": "affected", "version": "< 1.84.5"}, {"status": "affected", "version": "< 1.85.4"}, {"status": "affected", "version": "< 1.86.1"}]}], "descriptions": [{"lang": "en", "value": "SAP UI5 versions before 1.38.49, 1.52.49, 1.60.34, 1.71.31, 1.78.18, 1.84.5, 1.85.4, 1.86.1 allows an unauthenticated attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "Tabnabbing", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-03-03T15:55:27", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543"}, {"tags": ["x_refsource_MISC"], "url": "https://launchpad.support.sap.com/#/notes/3014303"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cna@sap.com", "ID": "CVE-2021-21476", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "SAP UI5", "version": {"version_data": [{"version_name": "<", "version_value": "1.38.49"}, {"version_name": "<", "version_value": "1.52.49"}, {"version_name": "<", "version_value": "1.60.34"}, {"version_name": "<", "version_value": "1.71.31"}, {"version_name": "<", "version_value": "1.78.18"}, {"version_name": "<", "version_value": "1.84.5"}, {"version_name": "<", "version_value": "1.85.4"}, {"version_name": "<", "version_value": "1.86.1"}]}}]}, "vendor_name": "SAP SE"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "SAP UI5 versions before 1.38.49, 1.52.49, 1.60.34, 1.71.31, 1.78.18, 1.84.5, 1.85.4, 1.86.1 allows an unauthenticated attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities."}]}, "impact": {"cvss": {"baseScore": "4.7", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Tabnabbing"}]}]}, "references": {"reference_data": [{"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543", "refsource": "MISC", "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543"}, {"name": "https://launchpad.support.sap.com/#/notes/3014303", "refsource": "MISC", "url": "https://launchpad.support.sap.com/#/notes/3014303"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T18:16:22.644Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://launchpad.support.sap.com/#/notes/3014303"}]}]}, "cveMetadata": {"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2021-21476", "datePublished": "2021-02-09T20:44:32", "dateReserved": "2020-12-30T00:00:00", "dateUpdated": "2024-08-03T18:16:22.644Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:ui5:*:*:*:*:*:*:*:*", "matchCriteriaId": "A6980394-2B06-4660-B495-E81FF13058CA", "versionEndExcluding": "1.38.49", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:ui5:*:*:*:*:*:*:*:*", "matchCriteriaId": "4FE5AAFE-6AFB-4F3C-9919-650611936BD7", "versionEndExcluding": "1.52.49", "versionStartIncluding": "1.50.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:ui5:*:*:*:*:*:*:*:*", "matchCriteriaId": "F88A1AE9-FF5E-4842-9C0E-A6C3DBB79CE6", "versionEndExcluding": "1.60.34", "versionStartIncluding": "1.60.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:ui5:*:*:*:*:*:*:*:*", "matchCriteriaId": "1A1646B5-02CE-480C-91CC-D9F7FD48AB0D", "versionEndExcluding": "1.71.31", "versionStartIncluding": "1.71.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:ui5:*:*:*:*:*:*:*:*", "matchCriteriaId": "53D55323-DA22-4D9A-9D9D-4372A86BEF65", "versionEndExcluding": "1.78.18", "versionStartIncluding": "1.78.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:ui5:*:*:*:*:*:*:*:*", "matchCriteriaId": "4BD70F05-C64D-4F82-A7AB-D512720211F2", "versionEndExcluding": "1.84.5", "versionStartIncluding": "1.84.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:ui5:*:*:*:*:*:*:*:*", "matchCriteriaId": "06FE28A7-74C3-4976-8CA7-FE446F85CD84", "versionEndExcluding": "1.85.4", "versionStartIncluding": "1.85.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:ui5:*:*:*:*:*:*:*:*", "matchCriteriaId": "5D89B55D-5557-44B8-A80C-212135299C08", "versionEndExcluding": "1.86.1", "versionStartIncluding": "1.86.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SAP UI5 versions before 1.38.49, 1.52.49, 1.60.34, 1.71.31, 1.78.18, 1.84.5, 1.85.4, 1.86.1 allows an unauthenticated attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities."}, {"lang": "es", "value": "SAP UI5, versiones anteriores a: 1.38.49, 1.52.49, 1.60.34, 1.71.31, 1.78.18, 1.84.5, 1.85.4, 1.86.1, permite a un atacante no autenticado redireccionar a usuarios a un sitio malicioso debido a vulnerabilidades de tipo Tabnabbing Inverso"}], "id": "CVE-2021-21476", "lastModified": "2021-04-01T12:47:52.530", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@sap.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-02-09T21:15:13.533", "references": [{"source": "cna@sap.com", "tags": ["Permissions Required", "Third Party Advisory"], "url": "https://launchpad.support.sap.com/#/notes/3014303"}, {"source": "cna@sap.com", "tags": ["Vendor Advisory"], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "nvd@nist.gov", "type": "Primary"}]}