CVE-2021-21476: SAP UI5

Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days.

SAP UI5 versions before 1.38.49, 1.52.49, 1.60.34, 1.71.31, 1.78.18, 1.84.5, 1.85.4, 1.86.1 allows an unauthenticated attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities.

Affected products

• SAP UI5: before 1.38.49 (fixed in 1.38.49); from 1.50.5, before 1.52.49 (fixed in 1.52.49); from 1.60.1, before 1.60.34 (fixed in 1.60.34); from 1.71.0, before 1.71.31 (fixed in 1.71.31); from 1.78.0, before 1.78.18 (fixed in 1.78.18); from 1.84.0, before 1.84.5 (fixed in 1.84.5); …

Published 2021-02-09. Last modified 2026-06-17.