Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2021-21480

EPSS 22.13% · P96
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2021-21480

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
SAP MII allows users to create dashboards and save them as JSP through the SSCE (Self Service Composition Environment). An attacker can intercept a request to the server, inject malicious JSP code in the request and forward to server. When this dashboard is opened by users having at least SAP_XMII Developer role, malicious content in the dashboard gets executed, leading to remote code execution in the server, which allows privilege escalation. The malicious JSP code can contain certain OS commands, through which an attacker can read sensitive files in the server, modify files or even delete contents in the server thus compromising the confidentiality, integrity and availability of the server hosting the SAP MII application. Also, an attacker authenticated as a developer can use the application to upload and execute a file which will permit them to execute operating systems commands completely compromising the server hosting the application.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
SAP MII 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP MII是德国思爱普（SAP）公司的一个应用软件。提供制造运营管理功能。 SAP MII 存在代码注入漏洞，该漏洞源于开发人员角色的用户打开此仪表板时，仪表板中的恶意内容将被执行，导致服务器中的远程代码执行，从而允许权限升级。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
SAP SESAP Manufacturing Integration and Intelligence < 15.1 -

II. Public POCs for CVE-2021-21480

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-21480

请登录查看更多情报信息。

Same Patch Batch · SAP SE · 2021-03-09 · 16 CVEs total

CVE-2021-27592SAP 3D Visual Enterprise Viewer 安全漏洞
CVE-2021-27590SAP 3D Visual Enterprise Viewer 安全漏洞
CVE-2021-27584SAP 3D Visual Enterprise Viewer 安全漏洞
CVE-2021-27588SAP 3D Visual Enterprise Viewer 安全漏洞
CVE-2021-27586SAP 3D Visual Enterprise Viewer 安全漏洞
CVE-2021-27587SAP 3D Visual Enterprise Viewer 安全漏洞
CVE-2021-27591SAP 3D Visual Enterprise Viewer 安全漏洞
CVE-2021-27589SAP 3D Visual Enterprise Viewer 安全漏洞
CVE-2021-27585SAP 3D Visual Enterprise Viewer 安全漏洞
CVE-2021-21484SAP HANA 安全漏洞
CVE-2021-21487思爱普 SAP Payment Engine 安全漏洞
CVE-2021-21493SAP 3D Visual Enterprise Viewer 安全漏洞
CVE-2021-21486SAP Enterprise Financial Services 安全漏洞
CVE-2021-21488SAP NetWeaver Knowledge Management Configuration Service 代码问题漏洞
CVE-2021-21481SAP Netweaver 安全漏洞

IV. Related Vulnerabilities

Same product: SAP Manufacturing Integration and Intelligence
Same vendor: SAP SE

V. Comments for CVE-2021-21480

No comments yet

Leave a comment