SB2021081307 - Multiple vulnerabilities in SAP Cloud Connector
Published: August 13, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Input validation error (CVE-ID: CVE-2021-33692)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient validation of user-supplied input. A remote non-authenticated attacker on the local network can send specially crafted input to the application and bypass security restrictions.
Successful vulnerability exploitation may result in information disclosure or unauthorized data modification.
2) Input validation error (CVE-ID: CVE-2021-33693)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient validation of user-supplied input. A remote non-authenticated attacker on the local network can send specially crafted input to the application and bypass security restrictions.
Successful vulnerability exploitation may result in information disclosure or unauthorized data modification.
3) Input validation error (CVE-ID: CVE-2021-33694)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient validation of user-supplied input. A remote non-authenticated attacker on the local network can send specially crafted input to the application and bypass security restrictions.
Successful vulnerability exploitation may result in information disclosure or unauthorized data modification.
4) Input validation error (CVE-ID: CVE-2021-33695)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient validation of user-supplied input. A remote non-authenticated attacker on the local network can send specially crafted input to the application and bypass security restrictions.
Successful vulnerability exploitation may result in information disclosure or unauthorized data modification.
Remediation
Install update from vendor's website.