PT-2021-7243 · Sap · Sap Mii

Nicolas Raus

·

Published

2021-03-09

·

Updated

2024-03-12

·

CVE-2021-21480

Report an issue
CVSS v2.0
9.0
VectorAV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions:

SAP MII (affected versions not specified)

Description:

The issue allows an attacker to intercept a request to the server, inject malicious JSP code in the request, and forward it to the server. When a dashboard is opened by users with at least the SAP XMII Developer role, the malicious content in the dashboard gets executed, leading to remote code execution in the server, which allows privilege escalation. The malicious JSP code can contain certain OS commands, through which an attacker can read sensitive files in the server, modify files, or even delete contents in the server, thus compromising the confidentiality, integrity, and availability of the server hosting the SAP MII application.

Recommendations:

At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94CWE-264

Related Identifiers

BDU:2022-04117
CVE-2021-21480

Affected Products

Sap Mii