PT-2021-17536 · Sap · Sap Manufacturing Execution

Published 2021-04-13 · Updated 2021-04-16 · CVE-2021-27600

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Manufacturing Execution (System Rules) versions 15.1 through 15.4

Description The issue allows an authorized attacker to embed malicious code into HTTP parameters and send it to the server because the SAP Manufacturing Execution (System Rules) tab does not sufficiently encode some parameters, resulting in a Stored Cross-Site Scripting (XSS) vulnerability. The malicious code can be used for different purposes, such as reading, modifying, and sending information to the attacker. However, the availability of the server cannot be impacted.

Recommendations For versions 15.1 through 15.4, update to a version that sufficiently encodes parameters to prevent Stored Cross-Site Scripting (XSS) vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-27600

Affected Products

Sap Manufacturing Execution

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-27600 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27600 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3024414 · Note
• https://t.me/cvenotify/13396 · Telegram Post