CVE-2021-21479

EUVD-2021-0526
In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availability and integrity of the system.
Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
sapCNA
8.1 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 99%
Affected Products (NVD)
VendorProductVersion
sapscimono
𝑥
< 0.0.19
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/SAP/scimono/security/advisories/GHSA-29q4-gxjq-rx5c
https://github.com/SAP/scimono/security/advisories/GHSA-29q4-gxjq-rx5c