CVE-2021-21490: 
SAP NetWeaver Application Server ABAP vulnerability analysis and mitigation

SAP NetWeaver AS for ABAP (Web Survey) versions 700, 702, 710, 711, 730, 731, 750, 752, 75A, and 75F was found to contain a reflected cross-site scripting vulnerability. The vulnerability was assigned CVE-2021-21490 and was disclosed on December 30, 2020 (CVE Details).

The vulnerability stems from insufficient encoding of input and output parameters in the Web Survey component. This cross-site scripting (XSS) vulnerability has been assigned a CVSS v3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicating moderate severity (NVD).

If successfully exploited, this vulnerability allows malicious users to access data related to the current session and potentially impersonate users, gaining access to all information with the same rights as the target user (CVE Details).

The vulnerability requires user interaction for successful exploitation, as indicated by the CVSS metrics. The attack vector is network-accessible with low attack complexity, requiring no privileges for exploitation (NVD).

SAP has released security patches to address this vulnerability through SAP Security Note 3004043 (SAP Note).