TI-2021-09052 Aliases CVE-2021-27600 GHSA-4pr6-x3xw-vrm6

Cross-site scripting in SAP Manufacturing Execution

LOW 25CWE-79Published 2021-04-13 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

SAP Manufacturing Execution (System Rules), versions - 15.1, 15.2, 15.3, 15.4, allows an authorized attacker to embed malicious code into HTTP parameter and send it to the server because SAP Manufacturing Execution (System Rules) tab does not sufficiently encode some parameters, resulting in Stored Cross-Site Scripting (XSS) vulnerability. The malicious code can be used for different purposes. e.g., information can be read, modified, and sent to the attacker. However, availability of the server cannot be impacted.

Why it matters now

EPSS 0.00606 49th percentileScored 2026-11-07

Fix Fixed SAP Manufacturing Execution (System Rules) (SAP SE): 15.1, 15.2, 15.3 +1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP Manufacturing Execution (System Rules)	before 15.1; before 15.2; before 15.3; before 15.4	15.1, 15.2, 15.3, 15.4	Patch available	CNA

SAP Manufacturing Execution (System Rules) VendorSAP Affected before 15.1; before 15.2; before 15.3; before 15.4 Fixed in 15.1, 15.2, 15.3, 15.4 Patch available CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:manufacturing_execution:15.1:::::::*	15.1	Vulnerable	SAP
cpe:2.3:a:sap:manufacturing_execution:15.2:::::::*	15.2	Vulnerable	SAP
cpe:2.3:a:sap:manufacturing_execution:15.3:::::::*	15.3	Vulnerable	SAP
cpe:2.3:a:sap:manufacturing_execution:15.4:::::::*	15.4	Vulnerable	SAP

cpe:2.3:a:sap:manufacturing_execution:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·SAP
cpe:2.3:a:sap:manufacturing_execution:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·SAP
cpe:2.3:a:sap:manufacturing_execution:15.3:*:*:*:*:*:*:* Versions 15.3 Vulnerable ·SAP
cpe:2.3:a:sap:manufacturing_execution:15.4:*:*:*:*:*:*:* Versions 15.4 Vulnerable ·SAP

Remediation

Fix · CNA SAP Manufacturing Execution (System Rules) (SAP SE) Fixed in 15.1, 15.2, 15.3, 15.4

Timeline

2026-10-02 Threatist record created from CVE-2021-27600
2026-10-03 Alias added: GHSA-4pr6-x3xw-vrm6

References

Advisory 1

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649

Other 1

https://launchpad.support.sap.com/#/notes/3024414

TI-2022-18800 Path traversal in SAP Manufacturing Execution CVSS 3.1HIGH 7.5
TI-2021-09067 Cross-site scripting in SAP Manufacturing Execution CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences