CVE-2021-33695 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	9.1 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
sap	CNA	6.8 MEDIUM	ADJACENT_NETWORK	HIGH	NONE	CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 30%

Vendor	Product	Version
sap	cloud_connector	2.0

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-297 - Improper Validation of Certificate with Host Mismatch
The software communicates with a host that provides a certificate, but the software does not properly ensure that the certificate is actually associated with that host.
CWE-295 - Improper Certificate Validation
The software does not validate, or incorrectly validates, a certificate.

References

https://launchpad.support.sap.com/#/notes/3058553

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806

https://launchpad.support.sap.com/#/notes/3058553

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806