CVE-2021-33694
- State
- Published
- Severity
- 5.9 Medium
- Published
- Sep 15, 2021
- Updated
- Aug 3, 2024
- Reserved
- May 28, 2021
Description
SAP Cloud Connector, version - 2.0, does not sufficiently encode user-controlled inputs, allowing an attacker with Administrator rights, to include malicious codes that get stored in the database, and when accessed, could be executed in the application, resulting in Stored Cross-Site Scripting.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 5.9 Medium | CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L | sap |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
SAP Cloud ConnectorSAP SE |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.