CVE-2021-33670

HIGH

SAP NetWeaver AS Java 7.10-7.50 - Denial of Service via HTTP Method Flooding

Title source: llm
STIX 2.1

Description

SAP NetWeaver AS for Java (Http Service Monitoring Filter), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send multiple HTTP requests with different method types thereby crashing the filter and making the HTTP server unavailable to other legitimate users leading to denial of service vulnerability.

References (4)

Core 4
Core References
Permissions Required x_refsource_misc
https://launchpad.support.sap.com/#/notes/3056652
Mailing List, Patch, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2022/May/4
Patch, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/166965/SAP-NetWeaver-Java-Denial-Of-Service.html

Scores

CVSS v3 7.5
EPSS 0.0556
EPSS Percentile 90.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

Status published
Products (7)
sap/netweaver_application_server_java 7.10
sap/netweaver_application_server_java 7.11
sap/netweaver_application_server_java 7.20
sap/netweaver_application_server_java 7.30
sap/netweaver_application_server_java 7.31
sap/netweaver_application_server_java 7.40
sap/netweaver_application_server_java 7.50
Published Jul 14, 2021
Tracked Since Feb 18, 2026