PT-2021-7243 · Sap · Sap Mii

Nicolas Raus · Published 2021-03-09 · Updated 2024-03-12 · CVE-2021-21480

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SAP MII (affected versions not specified)

Description The issue allows an attacker to intercept a request to the server, inject malicious JSP code in the request, and forward it to the server. When a dashboard is opened by users with at least the SAP XMII Developer role, the malicious content in the dashboard gets executed, leading to remote code execution in the server, which allows privilege escalation. The malicious JSP code can contain certain OS commands, through which an attacker can read sensitive files in the server, modify files, or even delete contents in the server, thus compromising the confidentiality, integrity, and availability of the server hosting the SAP MII application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

CWE-264

Related Identifiers

BDU:2022-04117

CVE-2021-21480

Affected Products

Sap Mii

References · 16

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21480 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04117 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-21480 · Security Note
• https://launchpad.support.sap.com/#/notes/3022622 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• http://seclists.org/fulldisclosure/2021/Jun/30 · Note
• https://t.me/secharvester/14942 · Telegram Post
• https://t.me/rnetsec/19738 · Telegram Post
• https://twitter.com/NeobeePaul/status/1739107080655741404 · Twitter Post
• https://t.me/true_secator/2847 · Telegram Post
• http://packetstormsecurity.com/files/163164/SAP-XMII-Remote-Code-Execution.html · Note
• https://twitter.com/reverseame/status/1767640965324353672 · Twitter Post
• https://t.me/defcon_news/120598 · Telegram Post
• https://t.me/cibsecurity/24614 · Telegram Post