CVE-2021-42063

MEDIUM EXPLOITED NUCLEI

SAP Knowledge Warehouse 7.30-7.50 - Cross-Site Scripting

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2021-42063 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including Cappricio-Securities. A Nuclei detection template is also available.

AI-analyzed exploit summary This repository contains a Python-based scanner for detecting CVE-2021-42063, a vulnerability in Microsoft Exchange Server. The tool checks for the presence of a specific SVG payload in HTTP responses to identify vulnerable endpoints.

Description

A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50. The usage of one SAP KW component within a Web browser enables unauthorized attackers to conduct XSS attacks, which might lead to disclose sensitive data.

Exploits (1)

nomisec SCANNER
by Cappricio-Securities · client-side
https://github.com/Cappricio-Securities/CVE-2021-42063

This repository contains a Python-based scanner for detecting CVE-2021-42063, a vulnerability in Microsoft Exchange Server. The tool checks for the presence of a specific SVG payload in HTTP responses to identify vulnerable endpoints.

Classification
Scanner 90%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Exchange Server
No auth needed
Prerequisites: Network access to the target Microsoft Exchange Server
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

SAP Knowledge Warehouse <=7.5.0 - Cross-Site Scripting
MEDIUMby pdteam
Shodan: http.favicon.hash:-266008933
FOFA: icon_hash=-266008933

References (4)

Core 4
Core References
Permissions Required x_refsource_misc
https://launchpad.support.sap.com/#/notes/3102769
Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2022/Mar/32

Scores

CVSS v3 6.1
EPSS 0.2232
EPSS Percentile 97.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

VulnCheck KEV 2024-04-18
CWE
CWE-79
Status published
Products (4)
sap/knowledge_warehouse 7.30
sap/knowledge_warehouse 7.31
sap/knowledge_warehouse 7.40
sap/knowledge_warehouse 7.50
Published Dec 14, 2021
Tracked Since Feb 18, 2026