CVE-2021-21477 Code injection in SAP Commerce
Authenticated attackers with specific privileges can inject malicious code into Drools rules, leading to remote code execution and host compromise.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-21477?
CVE-2021-21477 is a critical code injection vulnerability in SAP Commerce, published on 9 Feb 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with this privilege will be able to inject malicious code in the drools rules which when executed leads to Remote Code Execution vulnerability enabling the attacker to compromise the underlying host enabling him to impair confidentiality, integrity and availability of the application.
Weakness: CWE-94
Which versions are affected by CVE-2021-21477?
It affects 1 product.
Products include Sap Commerce.
How do I fix CVE-2021-21477?
No fix has been published for CVE-2021-21477 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-21477 being exploited?
There is no known exploitation of CVE-2021-21477 in the wild and no public exploit code.
Other vulnerabilities in SAP Commerce
Sources
Also known as GHSA-jg2g-jq85-v7jw.