Stored Cross-Site Scripting in SAP Contact Center by SAP
CVE-2021-33673

8.3HIGH

Key Information:

Vendor
SAP
Status
SAP Contact Center
Vendor
CVE Published:
14 September 2021

Summary

The SAP Contact Center application version 700 is vulnerable to a Stored Cross-Site Scripting (XSS) issue, which occurs due to insufficient encoding of user-controlled inputs. When users navigate the employee directory, attackers can exploit this vulnerability to execute arbitrary code on the user's browser. Furthermore, with the integration of ActiveX within the application, attackers gain the capability to execute operating system-level commands, significantly increasing the potential impact of this vulnerability.

Affected Version(s)

SAP Contact Center < 700

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/3073891
x_refsource_MISC

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.