CVE-2021-33669

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-09 · updated 2026-06-17
Weakness: CWE-668

Description

Under certain conditions, SAP Mobile SDK Certificate Provider allows a local unprivileged attacker to exploit an insecure temporary file storage. For a successful exploitation user interaction from another user is required and could lead to complete impact of confidentiality integrity and availability.

Affected products

SAP SE SAP Mobile SDK Certificate Provider: before 3.0.8 — fixed in 3.0.8

How to fix

Upgrade to a fixed version: SAP SE SAP Mobile SDK Certificate Provider 3.0.8. Check the vendor advisory for mitigations.

References

https://github.com/SAP/mobilesdk-certificateprovider/security/advisories/GHSA-r2j9-h6q9-cq8g
https://github.com/SAP/mobilesdk-certificateprovider/security/advisories/GHSA-r2j9-h6q9-cq8g

Get alerted when CVE-2021-33669 or the next vulnerability affects your stack