CVE-2021-33672

Katalog CVE

CVSS 9.6 · Critical EPSS 1,1%

Kerentanan Improper Encoding or Escaping of Output pada sap contact center. Skor CVSS 3.1 9.6 (Critical) menurut NVD.

Deskripsi (NVD)

Due to missing encoding in SAP Contact Center's Communication Desktop component- version 700, an attacker could send malicious script in chat message. When the message is accepted by the chat recipient, the script gets executed in their scope. Due to the usage of ActiveX in the application, the attacker can further execute operating system level commands in the chat recipient's scope. This could lead to a complete compromise of their confidentiality, integrity, and could temporarily impact their availability.

Rincian

Terbit di NVD

14 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.6 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-116: Improper Encoding or Escaping of Output

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 64,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 advisory vendor
• https://launchpad.support.sap.com/#/notes/3073891 permissions required