PT-2021-17538 · Sap · Sap Commerce

Published 2021-04-13 · Updated 2021-04-21 · CVE-2021-27602

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Commerce versions 1808, 1811, 1905, 2005, 2011

Description The Backoffice application in SAP Commerce allows authorized users to create source rules that are translated to drools rules when published to certain modules within the application. An attacker with this authorization can inject malicious code in the source rules, enabling them to perform remote code execution and compromise the confidentiality, integrity, and availability of the application.

Recommendations For versions 1808, 1811, 1905, 2005, 2011, consider restricting access to the Backoffice application and limiting the ability to create source rules to minimize the risk of exploitation. As a temporary workaround, consider disabling the publication of source rules to certain modules within the application until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2021-27602

Affected Products

Sap Commerce

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-27602 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27602 · Vendor Advisory
• https://t.me/cvenotify/13178 · Telegram Post
• https://launchpad.support.sap.com/#/notes/3040210 · Note
• https://t.me/cvenotify/13179 · Telegram Post