PT-2021-20271 · Sap · Sap Cloud Connector

Published 2021-09-15 · Updated 2021-09-28 · CVE-2021-33694

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: SAP Cloud Connector version 2.0

Description: The issue arises from insufficient encoding of user-controlled inputs, allowing an attacker with Administrator rights to include malicious codes that get stored in the database. When accessed, these codes could be executed in the application, resulting in Stored Cross-Site Scripting.

Recommendations: For SAP Cloud Connector version 2.0, ensure that all user-controlled inputs are properly encoded to prevent the inclusion of malicious codes. As a temporary workaround, consider restricting access to the database and limiting the execution of stored codes until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-33694

Affected Products

Sap Cloud Connector

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-33694 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33694 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806 · Vendor Advisory
• https://t.me/cibsecurity/28951 · Telegram Post
• https://launchpad.support.sap.com/#/notes/3058553 · Note
• https://t.me/cvenotify/20918 · Telegram Post