CVE-2021-27602

published 2021-04-13

CVE-2021-27602: SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to…

Priority P2 63 critical 9.9 CVSS 3.1

AV N AC L PR L UI N S C C H I H A H

SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to drools rule when published to certain modules within the application. An attacker with this authorization can inject malicious code in the source rules and perform remote code execution enabling them to compromise the confidentiality, integrity and availability of the application.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
sap	commerce	—	—
sap	commerce	—	—
sap	commerce	—	—
sap	commerce	—	—
sap	commerce	—	—
sap_se	sap_commerce	< 1808	1808
sap_se	sap_commerce	< 1811	1811
sap_se	sap_commerce	< 1905	1905
sap_se	sap_commerce	< 2005	2005
sap_se	sap_commerce	< 2011	2011

CVSS provenance

nvd v3.1 9.9 CRITICAL CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

nvd v3.0 9.9 CRITICAL CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94