QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2021-27600

Back to search

CVE-2021-27600

Published: Apr 13, 2021

Modified: Aug 3, 2024

PUBLISHED

CVSS v3.0

6.4

MEDIUM

Description

SAP Manufacturing Execution (System Rules), versions - 15.1, 15.2, 15.3, 15.4, allows an authorized attacker to embed malicious code into HTTP parameter and send it to the server because SAP Manufacturing Execution (System Rules) tab does not sufficiently encode some parameters, resulting in Stored Cross-Site Scripting (XSS) vulnerability. The malicious code can be used for different purposes. e.g., information can be read, modified, and sent to the attacker. However, availability of the server cannot be impacted.

VendorProductVersions

SAP SE

SAP Manufacturing Execution (System Rules)

affected
< 15.1
affected
< 15.2
affected
< 15.3
affected
< 15.4

CVSS v3.0 Details

CVSS v3.0 Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now