CVE-2021-21480

SAP MII allows users to create dashboards and save them as JSP through the SSCE Self Service Composition Environment. An attacker can intercept a request to the server, inject malicious JSP code in the request and forward to server. When this dashboard is opened by users having at least SAPXMII...

CVE-2021-21480

SAP MII’s Self Service Composition Environment (SSCE) lets dashboards be saved as JSP files. CVE-2021-21480 is a code-injection/remote code execution vulnerability where an attacker can intercept a dashboard request, inject JSP, and have it executed when opened by a user with SAP_XMII Developer p...