PT-2021-20244 · Sap · Sap Commerce Cloud

Published 2021-06-09 · Updated 2021-06-21 · CVE-2021-33666

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: SAP Commerce Cloud version 100

Description: The issue concerns MIME sniffing, which under certain circumstances could facilitate an XSS attack or malware proliferation when SAP Commerce Cloud hosts a JavaScript storefront.

Recommendations: For SAP Commerce Cloud version 100, consider implementing proper MIME type handling to prevent MIME sniffing attacks, which could help mitigate the risk of XSS or malware proliferation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-33666

Affected Products

Sap Commerce Cloud

References · 4

• https://osv.dev/vulnerability/CVE-2021-33666 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2985562 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33666 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999 · Vendor Advisory