{"cve":"CVE-2021-33672","nvd":{"published":"2021-09-14T12:15:08.793","modified":"2026-06-17T03:55:00.283","status":"Modified","description":"Due to missing encoding in SAP Contact Center's Communication Desktop component- version 700, an attacker could send malicious script in chat message. When the message is accepted by the chat recipient, the script gets executed in their scope. Due to the usage of ActiveX in the application, the attacker can further execute operating system level commands in the chat recipient's scope. This could lead to a complete compromise of their confidentiality, integrity, and could temporarily impact their availability.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":9.6},"cwes":["CWE-116"],"references":["https://launchpad.support.sap.com/#/notes/3073891","https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405","https://launchpad.support.sap.com/#/notes/3073891","https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405"],"products":["sap:contact_center"],"source":"nvd","synced_at":"2026-10-19T21:23:41.316049955+00:00"},"epss":{"cve":"CVE-2021-33672","score":0.011,"percentile":0.65672,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}