Lucene search

[email protected]CVE-2021-27602

HistoryApr 13, 2021 - 7:15 p.m.

CVE-2021-27602

2021-04-1319:15:15

CWE-94

[email protected]

web.nvd.nist.gov

sap commerce

source rules

drools rule

remote code execution

cve-2021-27602

nvd

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

8.4 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

71.7%

JSON

SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to drools rule when published to certain modules within the application. An attacker with this authorization can inject malicious code in the source rules and perform remote code execution enabling them to compromise the confidentiality, integrity and availability of the application.

Affected configurations

NVD

Node

sapcommerceMatch1808

sapcommerceMatch1811

sapcommerceMatch1905

sapcommerceMatch2005

sapcommerceMatch2011

CPENameOperatorVersion
sap:commercesap commerceeq1808
sap:commercesap commerceeq1811
sap:commercesap commerceeq1905
sap:commercesap commerceeq2005
sap:commercesap commerceeq2011

CPE	Name	Operator	Version
sap:commerce	sap commerce	eq	1808
sap:commerce	sap commerce	eq	1811
sap:commerce	sap commerce	eq	1905
sap:commerce	sap commerce	eq	2005
sap:commerce	sap commerce	eq	2011

CNA Affected

[
  {
    "product": "SAP Commerce",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 1808"
      },
      {
        "status": "affected",
        "version": "< 1811"
      },
      {
        "status": "affected",
        "version": "< 1905"
      },
      {
        "status": "affected",
        "version": "< 2005"
      },
      {
        "status": "affected",
        "version": "< 2011"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/3040210

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649

Social References

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

8.4 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

71.7%

JSON

Related for CVE-2021-27602

nvd1 cvelist1 prion1 malwarebytes1