CVE-2021-21491: SAP NetWeaver Application Server Java

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

SAP Netweaver Application Server Java (Applications based on WebDynpro Java) versions 7.00, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allow an attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities.

Affected products

• SAP NetWeaver Application Server Java: version 7.00 only; version 7.10 only; version 7.11 only; version 7.20 only; version 7.30 only; version 7.31 only; …

Published 2021-03-10. Last modified 2026-06-17.