CVE-2021-21477

published 2021-02-09

CVE-2021-21477: SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with…

Priority P2 75 critical 9.9 CVSS 3.1

AV N AC L PR L UI N S C C H I H A H

SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with this privilege will be able to inject malicious code in the drools rules which when executed leads to Remote Code Execution vulnerability enabling the attacker to compromise the underlying host enabling him to impair confidentiality, integrity and availability of the application.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
sap	commerce	—	—
sap	commerce	—	—
sap	commerce	—	—
sap	commerce	—	—
sap	commerce	—	—
sap_se	sap_commerce	< 1808	1808
sap_se	sap_commerce	< 1811	1811
sap_se	sap_commerce	< 1905	1905
sap_se	sap_commerce	< 2005	2005
sap_se	sap_commerce	< 2011	2011

Detection & IOCs extracted from sources · hover to see the quote

• → Authenticated attacker with drools rule editing privileges can inject malicious code into drools rules to achieve Remote Code Execution on SAP Commerce Cloud ↗

• · Vulnerability affects SAP Commerce Cloud versions 1808, 1811, 1905, 2005, and 2011 only ↗
• · Exploitation requires authentication and specific drools rule editing privileges — not exploitable by unauthenticated or low-privileged users ↗

CVSS provenance

nvd v3.1 9.9 CRITICAL CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

nvd v3.0 9.9 CRITICAL CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

nvd v2.0 9.0 CRITICAL AV:N/AC:L/Au:S/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94