PT-2021-20250 · Sap · Sap Contact Center

Published 2021-09-14 · Updated 2021-09-24 · CVE-2021-33672

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SAP Contact Center's Communication Desktop component version 700

Description: The issue arises from missing encoding in the Communication Desktop component, allowing an attacker to send malicious scripts via chat messages. When a recipient accepts the message, the script executes in their scope. The application's use of ActiveX enables the attacker to execute operating system level commands, potentially compromising the recipient's confidentiality and integrity, and temporarily impacting their availability.

Recommendations: For version 700, consider disabling the usage of ActiveX in the application as a temporary workaround to minimize the risk of exploitation. Additionally, restrict the execution of scripts in chat messages to prevent operating system level commands from being executed. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2021-33672

Affected Products

Sap Contact Center

References · 7

• https://osv.dev/vulnerability/CVE-2021-33672 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33672 · Security Note
• https://t.me/isacarusec/4439 · Telegram Post
• https://t.me/cvenotify/21399 · Telegram Post
• https://launchpad.support.sap.com/#/notes/3073891 · Note
• https://t.me/true_secator/2111 · Telegram Post