Vulnerability · Published Sep 14, 2021 · Assigned by sap

CVE-2021-33672

Critical 9.6

In plain English

A critical-severity security flaw in SAP Contact Center from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).

Severity (CVSS 3.0)9.6Critical

Exploit odds (30 days)1.1%top 34.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Due to missing encoding in SAP Contact Center's Communication Desktop component- version 700, an attacker could send malicious script in chat message. When the message is accepted by the chat recipient, the script gets executed in their scope. Due to the usage of ActiveX in the application, the attacker can further execute operating system level commands in the chat recipient's scope. This could lead to a complete compromise of their confidentiality, integrity, and could temporarily impact their availability.

Affected products (as reported)

Vendor	Product	Versions
SAP SE	SAP Contact Center	< 700

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 x_refsource_MISC
https://launchpad.support.sap.com/#/notes/3073891 x_refsource_MISC