What is CVE-2021-21477?

CVE-2021-21477 is a critical-severity vulnerability in Sap Commerce, classified under Code Injection. CVSS score: 9.9/10. Published 2021-02-09.

How severe is CVE-2021-21477?

Critical severity. CVSS v3 base score is 9.9 out of 10.

RCE in Sap Commerce

CVE-2021-21477

SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with this privilege will be able to inject malicious code in the drools rules which whe…

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.298 (98.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

Affected products

Sap Commerce — versions 1808, 1811, 1905
Sap Se Commerce — versions < 1808, < 1811, < 1905

Weakness classification (CWE)

CWE-94 — Code Injection

References

cna@sap.com (x_refsource_MISC, Vendor Advisory)
cna@sap.com (Permissions Required, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-21477?: CVE-2021-21477 is a critical-severity vulnerability in Sap Commerce, classified under Code Injection. CVSS score: 9.9/10. Published 2021-02-09.
How severe is CVE-2021-21477?: Critical severity. CVSS v3 base score is 9.9 out of 10.