Vulnerability identifier: #VU55833
Vulnerability risk: Medium
CVSSv4.0: 4.9 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-33695
CWE-ID:
CWE-20
Exploitation vector: Local network
Exploit availability: No
Vulnerable software:
SAP Cloud Connector
Client/Desktop applications /
Software for system administration
Vendor: SAP
Description
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient validation of user-supplied input. A remote non-authenticated attacker on the local network can send specially crafted input to the application and bypass security restrictions.
Successful vulnerability exploitation may result in information disclosure or unauthorized data modification.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
SAP Cloud Connector: 2.0
External links
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
