PT-2021-20272 · Sap · Sap Cloud Connector

Published 2021-09-15 · Updated 2021-09-28 · CVE-2021-33695

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: SAP Cloud Connector version 2.0

Description: The issue is related to insufficient validation of the certificate when the SAP Cloud Connector communicates with the backend. This could potentially lead to security risks.

Recommendations: For SAP Cloud Connector version 2.0, ensure that proper certificate validation is implemented to secure communication with the backend. As a temporary workaround, consider enhancing the validation process for certificates until a formal fix is available.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-297

CWE-295

Related Identifiers

CVE-2021-33695

Affected Products

Sap Cloud Connector

References · 7

• https://osv.dev/vulnerability/CVE-2021-33695 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33695 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3058553 · Note
• https://t.me/cibsecurity/28950 · Telegram Post
• https://t.me/cvenotify/20915 · Telegram Post
• https://t.me/cvenotify/20935 · Telegram Post