XSS in SAP Cloud Connector
CVE-2021-33694
SAP Cloud Connector, version - 2.0, does not sufficiently encode user-controlled inputs, allowing an attacker with Administrator rights, to include malicious codes that get stored in the database, and when accessed, could be executed in the application, resulting in Stored Cross-Site Scripting.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.005 (37.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 38th percentile — 37.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- SAP Cloud Connector — versions 2.0
- SAP Se Cloud Connector — versions < 2.0
Weakness classification (CWE)
References
- wiki.scn.sap.com/wiki/pages/viewpage.action (Patch, Vendor Advisory)
- launchpad.support.sap.com/ (Permissions Required)
Frequently asked questions
- What is CVE-2021-33694?
- CVE-2021-33694 is a medium-severity vulnerability in SAP Cloud Connector, classified under Cross-site Scripting. CVSS score: 4.8/10. Published 2021-09-15.
- How severe is CVE-2021-33694?
- Medium severity. CVSS v3 base score is 4.8 out of 10.