PT-2021-20251 · Sap · Sap Contact Center

Published 2021-09-14 · Updated 2021-09-24 · CVE-2021-33673

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions: SAP Contact Center version 700

Description: The issue arises from insufficient encoding of user-controlled inputs, which are persisted. This allows an attacker to exploit a Stored Cross-Site Scripting (XSS) vulnerability when a user browses through the employee directory, enabling the execution of arbitrary code on the victim's browser. The application's use of ActiveX allows the attacker to further execute operating system level commands.

Recommendations: For SAP Contact Center version 700, consider disabling the usage of ActiveX in the application as a temporary workaround to minimize the risk of exploitation. Restrict access to the employee directory to prevent attackers from executing arbitrary code on the victim's browser. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-33673

Affected Products

Sap Contact Center

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-33673 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33673 · Vendor Advisory
• https://t.me/isacarusec/4439 · Telegram Post
• https://t.me/cvenotify/21397 · Telegram Post
• https://launchpad.support.sap.com/#/notes/3073891 · Note
• https://t.me/true_secator/2111 · Telegram Post