CVE-2021-27602
Last modified
CVE-2021-27602 is a critical-severity vulnerability rated 9.9/10 on the CVSS scale. SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to drools rule when published to certain modules within the application. An attacker with this authorization can inject malicious code in the source rules and perform remote code execution enabling them to compromise the confidentiality, integrity and availability of the application.. EPSS estimates a 2.00% chance of exploitation in the next 30 days.
Description
SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to drools rule when published to certain modules within the application. An attacker with this authorization can inject malicious code in the source rules and perform remote code execution enabling them to compromise the confidentiality, integrity and availability of the application.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sap | Commerce | 1808 |
| Sap | Commerce | 1811 |
| Sap | Commerce | 1905 |
| Sap | Commerce | 2005 |
| Sap | Commerce | 2011 |
References
- https://launchpad.support.sap.com/#/notes/3040210Permissions Required
- https://launchpad.support.sap.com/#/notes/3040210Permissions Required
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-27602?
How severe is CVE-2021-27602?
How do I fix CVE-2021-27602?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-27596When a user opens manipulated Autodesk 3D Studio for MS-DOS …3.3
- CVE-2021-27597SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NU…7.5
- CVE-2021-27598SAP NetWeaver AS JAVA (Customer Usage Provisioning Servlet),…5.3
- CVE-2021-27599SAP NetWeaver ABAP Server and ABAP Platform (Process Integra…6.5
- CVE-2021-27600SAP Manufacturing Execution (System Rules), versions - 15.1,…5.4
- CVE-2021-27601SAP NetWeaver AS Java (Applications based on HTMLB for Java)…5.4
- CVE-2021-27603An RFC enabled function module SPI_WAIT_MILLIS in SAP NetWea…6.5
- CVE-2021-27604In order to prevent XML External Entity vulnerability in SAP…6.5
- CVE-2021-27605SAP's HCM Travel Management Fiori Apps V2, version - 608, do…4.3
- CVE-2021-27606SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server)…7.5
- CVE-2021-27607SAP NetWeaver ABAP Server and ABAP Platform (Dispatcher), ve…7.5
- CVE-2021-27608An unquoted service path in SAPSetup, version - 9.0, could l…7.5
Are you affected by CVE-2021-27602?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST