TI-2021-04575 Aliases CVE-2021-21477 GHSA-jg2g-jq85-v7jw

Code injection in SAP Commerce

HIGH 66CWE-94Published 2021-02-09 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-94.

Summary

SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with this privilege will be able to inject malicious code in the drools rules which when executed leads to Remote Code Execution vulnerability enabling the attacker to compromise the underlying host enabling him to impair confidentiality, integrity and availability of the application.

Why it matters now

EPSS 0.29847 98th percentileScored 2026-11-07

Fix Fixed SAP Commerce (SAP SE): 1808, 1811, 1905 +2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP Commerce	before 1808; before 1811; before 1905; before 2005; before 2011	1808, 1811, 1905, 2005, 2011	Patch available	CNA

SAP Commerce VendorSAP Affected before 1808; before 1811; before 1905; before 2005; before 2011 Fixed in 1808, 1811, 1905, 2005, 2011 Patch available CNA

CPE configurations NVD · 5

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:commerce:1808:::::::*	1808	Vulnerable	SAP
cpe:2.3:a:sap:commerce:1811:::::::*	1811	Vulnerable	SAP
cpe:2.3:a:sap:commerce:1905:::::::*	1905	Vulnerable	SAP
cpe:2.3:a:sap:commerce:2005:::::::*	2005	Vulnerable	SAP
cpe:2.3:a:sap:commerce:2011:::::::*	2011	Vulnerable	SAP

cpe:2.3:a:sap:commerce:1808:*:*:*:*:*:*:* Versions 1808 Vulnerable ·SAP
cpe:2.3:a:sap:commerce:1811:*:*:*:*:*:*:* Versions 1811 Vulnerable ·SAP
cpe:2.3:a:sap:commerce:1905:*:*:*:*:*:*:* Versions 1905 Vulnerable ·SAP
cpe:2.3:a:sap:commerce:2005:*:*:*:*:*:*:* Versions 2005 Vulnerable ·SAP
cpe:2.3:a:sap:commerce:2011:*:*:*:*:*:*:* Versions 2011 Vulnerable ·SAP

Remediation

Fix · CNA SAP Commerce (SAP SE) Fixed in 1808, 1811, 1905, 2005, 2011

Timeline

2026-10-02 Threatist record created from CVE-2021-21477
2026-10-03 Alias added: GHSA-jg2g-jq85-v7jw

References

Advisory 1

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543

Other 1

https://launchpad.support.sap.com/#/notes/3014121

TI-2021-09054 Code injection in SAP Commerce CVSS 3.1CRITICAL 9.9
TI-2020-05120 Hard-coded credentials in SAP Commerce CVSS 3.1CRITICAL 9.8
TI-2021-18574 SQL injection in SAP Commerce CVSS 3.1CRITICAL 9.8
TI-2022-19716 Open redirect in SAP Commerce CVSS 3.1HIGH 8.8
TI-2021-17549 Missing authorization in SAP Commerce CVSS 3.1HIGH 8.8
TI-2020-05154 Session fixation in SAP Commerce CVSS 3.1HIGH 8.1

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences