Security readout for executives and security teams
Plain-English summary
CVE-2021-33669 is a high-severity local issue in SAP Mobile SDK Certificate Provider. A local unprivileged attacker could abuse insecure temporary file storage, but successful exploitation requires another user to interact. If exploited, the impact can include loss of confidentiality, integrity, and availability.
Executive priority
Treat this as a high-priority patching item where the component exists, especially on shared or developer systems. It is not presented as remotely exploitable or actively exploited in the supplied sources, but the stated potential business impact is complete confidentiality, integrity, and availability compromise.
Technical view
SAP Mobile SDK Certificate Provider versions before 3.0.8 are affected. The CVSS 3.0 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local access, low attack complexity, no attacker privileges, required user interaction, unchanged scope, and high CIA impact. No CWE is listed in the provided sources.
Likely exposure
Exposure applies where SAP Mobile SDK Certificate Provider before 3.0.8 is installed or bundled. Risk is most relevant on endpoints, developer machines, build systems, or shared environments where local access and another user's interaction are plausible.
Exploitation context
The provided sources do not show active exploitation, and the CVE is not listed as KEV. Exploitation requires local access and user interaction from another user. The sources do not provide enough detail to assess common exploit tooling or practical exploit reliability.
Researcher notes
Key constraints are local attack surface, no required attacker privileges, required victim interaction, and insecure temporary file storage. Public source detail is limited; avoid assuming affected platforms, file paths, or exploit mechanics beyond SAP Mobile SDK Certificate Provider before 3.0.8.
Mitigation direction
- Upgrade SAP Mobile SDK Certificate Provider to version 3.0.8 or later.
- Review SAP's GitHub security advisory for official remediation guidance.
- Remove or isolate affected installations that cannot be upgraded promptly.
- Limit local access to systems running affected versions.
- Prioritize shared systems where cross-user interaction is realistic.
Validation and detection
- Inventory systems for SAP Mobile SDK Certificate Provider installations.
- Confirm installed versions are not earlier than 3.0.8.
- Check whether affected software is bundled in mobile build or deployment workflows.
- Review endpoint and build-host access models for untrusted local users.
- Track SAP advisory updates for any additional mitigation details.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-33669 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
7.8HighVector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/SAP/mobilesdk-certificateprovider/security/advisories/GHSA-r2j9-h6q9-cq8gCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.