CVE-2021-33670

SAP NetWeaver AS for Java (Http Service Monitoring Filter), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send multiple HTTP requests with different method types thereby crashing the filter and making the HTTP server unavailable to other legitimate users leading to denial of service vulnerability.

Score

CVSS 3.1 7.5 High

Status

Modified - cna@sap.com

Published

2021-07-14

Last modified

2024-08-03

Affected products

• Netweaver Application Server Java (Sap)
• Sap Netweaver As For Java Http Service (Sap Se)

References

• http://packetstormsecurity.com/files/166965/SAP-NetWeaver-Java-Denial-Of-Service.html
• http://seclists.org/fulldisclosure/2022/May/4
• https://launchpad.support.sap.com/#/notes/3056652
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506