Read the docs
TI-2021-04578 Aliases CVE-2021-21480GHSA-9q82-vh99-v4rp

Code injection in SAP Manufacturing Integration and Intelligence

Priority HIGH 72CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-94.

Summary

SAP MII allows users to create dashboards and save them as JSP through the SSCE (Self Service Composition Environment). An attacker can intercept a request to the server, inject malicious JSP code in the request and forward to server. When this dashboard is opened by users having at least SAP_XMII Developer role, malicious content in the dashboard gets executed, leading to remote code execution in the server, which allows privilege escalation. The malicious JSP code can contain certain OS commands, through which an attacker can read sensitive files in the server, modify files or even delete contents in the server thus compromising the confidentiality, integrity and availability of the server hosting the SAP MII application. Also, an attacker authenticated as a developer can use the application to upload and execute a file which will permit them to execute operating systems commands completely compromising the server hosting the application.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.52101 98th percentileScored 2026-11-07
Fix Fixed SAP Manufacturing Integration and Intelligence (SAP SE): 15.1, 15.2, 15.3 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP Manufacturing Integration and Intelligencebefore 15.1; before 15.2; before 15.3; before 15.415.1, 15.2, 15.3, 15.4Patch availableCNA
  • SAP Manufacturing Integration and Intelligence VendorSAP Affected before 15.1; before 15.2; before 15.3; before 15.4 Fixed in 15.1, 15.2, 15.3, 15.4 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:sap:manufacturing_integration_and_intelligence:15.1:*:*:*:*:*:*:*15.1VulnerableSAP
cpe:2.3:a:sap:manufacturing_integration_and_intelligence:15.2:*:*:*:*:*:*:*15.2VulnerableSAP
cpe:2.3:a:sap:manufacturing_integration_and_intelligence:15.3:*:*:*:*:*:*:*15.3VulnerableSAP
cpe:2.3:a:sap:manufacturing_integration_and_intelligence:15.4:*:*:*:*:*:*:*15.4VulnerableSAP
  • cpe:2.3:a:sap:manufacturing_integration_and_intelligence:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·SAP
  • cpe:2.3:a:sap:manufacturing_integration_and_intelligence:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·SAP
  • cpe:2.3:a:sap:manufacturing_integration_and_intelligence:15.3:*:*:*:*:*:*:* Versions 15.3 Vulnerable ·SAP
  • cpe:2.3:a:sap:manufacturing_integration_and_intelligence:15.4:*:*:*:*:*:*:* Versions 15.4 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP Manufacturing Integration and Intelligence (SAP SE) Fixed in 15.1, 15.2, 15.3, 15.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21480
  2. 2026-10-03 Alias added: GHSA-9q82-vh99-v4rp

References

Advisory 5

  • TI-2019-00230 Cross-site request forgery in SAP Manufacturing Integration and Intelligence CVSS 3.0HIGH 8.8
  • TI-2015-06856 SAP Manufacturing Integration and Intelligence (aka MII, formerly xMII) uses weak… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences