GitHub Advisoryadvisory · Maven

GHSA-29q4-gxjq-rx5c Remote Code Execution in SCIMono

HIGH Published 2021-02-10 Modified 2021-02-10 Official page ↗
Aliases
CVE-2021-21479
Ecosystem
Maven
Packages
com.sap.scimono:scimono-server
Severity
High
Weaknesses
CWE-59, CWE-62, CWE-690, CWE-74, CWE-77, CWE-917
Reviewed
2021-02-10

Affected packages

• Maven com.sap.scimono:scimono-server: < 0.0.19 → fixed in 0.0.19

Description

Impact It is possible for attacker to inject and execute java expression and compromising the availability and integrity of the system. Patches The issue was fixed on 0.0.19 version

Related

Alias · CVE (1)

  • CVE-2021-21479 In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availability and integrity… vulnerability

Weakness · CWE (6)

  • CWE-59 Improper Link Resolution Before File Access weakness
  • CWE-62 UNIX Hard Link weakness
  • CWE-690 Unchecked Return Value to NULL Pointer Dereference weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness
  • CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement weakness

References