Stored Cross-Site Scripting in SAP Cloud Connector by SAP
CVE-2021-33694

5.9MEDIUM

Key Information:

Vendor
SAP
Status
SAP Cloud Connector
Vendor
CVE Published:
15 September 2021

Summary

The SAP Cloud Connector version 2.0 contains a vulnerability whereby insufficient encoding of user-controlled inputs enables an attacker with Administrator privileges to inject malicious code. This code can be stored in the database and executed when accessed through the application, leading to serious security risks associated with Stored Cross-Site Scripting.

Affected Version(s)

SAP Cloud Connector < 2.0

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/3058553
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.