CVE-2021-33672 Vulnerability Details

  /     /     /  

CVE-2021-33672 Metadata Quick Info

CVE Published: 14/09/2021 | CVE Updated: 03/08/2024 | CVE Year: 2021
Source: sap | Vendor: SAP SE | Product: SAP Contact Center
Status : PUBLISHED

---

CVE-2021-33672 Description

Due to missing encoding in SAP Contact Center\'s Communication Desktop component- version 700, an attacker could send malicious script in chat message. When the message is accepted by the chat recipient, the script gets executed in their scope. Due to the usage of ActiveX in the application, the attacker can further execute operating system level commands in the chat recipient\'s scope. This could lead to a complete compromise of their confidentiality, integrity, and could temporarily impact their availability.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID:
CWE Name: OS Command Injection
Source: SAP SE

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).