RCE in SAP Commerce
CVE-2021-27602
SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to drools rule when published to certain modules within the application. An attacker with this authorization can inject malicious code in the source rules and perform remote code execution enabling them to compromise the confidentiality, integrity and availability of the application.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.020 (79.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Sap Commerce — versions 1808, 1811, 1905
- Sap Se Commerce — versions < 1808, < 1811, < 1905
Weakness classification (CWE)
References
- cna@sap.com (x_refsource_MISC, Vendor Advisory)
- cna@sap.com (Permissions Required, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-27602?
- CVE-2021-27602 is a critical-severity vulnerability in SAP Commerce, classified under Code Injection. CVSS score: 9.9/10. Published 2021-04-13.
- How severe is CVE-2021-27602?
- Critical severity. CVSS v3 base score is 9.9 out of 10.