CVE-2021-33672
CRITICALSAP Contact Center 700 - Stored Cross-Site Scripting and Remote Code Execution via Chat Message
Title source: llmDescription
Due to missing encoding in SAP Contact Center's Communication Desktop component- version 700, an attacker could send malicious script in chat message. When the message is accepted by the chat recipient, the script gets executed in their scope. Due to the usage of ActiveX in the application, the attacker can further execute operating system level commands in the chat recipient's scope. This could lead to a complete compromise of their confidentiality, integrity, and could temporarily impact their availability.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_misc
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405
Permissions Required x_refsource_misc
https://launchpad.support.sap.com/#/notes/3073891
Scores
CVSS v3
9.6
EPSS
0.0027
EPSS Percentile
50.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Details
CWE
CWE-116
Status
published
Products (1)
sap/contact_center
700
Published
Sep 14, 2021
Tracked Since
Feb 18, 2026