Vulnerability record · CVE-2021-21480 · published 9 March 2021
CVE-2021-21480: SAP MII dashboard JSP injection enables remote code execution
Sap · Manufacturing Integration And Intelligence
SAP Manufacturing Integration and Intelligence (MII) lets users build dashboards and save them as JSP through the Self Service Composition Environment. An attacker can intercept a request and inject malicious JSP code that executes when a user with at least the SAP_XMII Developer role opens the dashboard. This yields remote code execution on the server hosting the application.
Description
SAP MII allows users to create dashboards and save them as JSP through the SSCE (Self Service Composition Environment). An attacker can intercept a request to the server, inject malicious JSP code in the request and forward to server. When this dashboard is opened by users having at least SAP_XMII Developer role, malicious content in the dashboard gets executed, leading to remote code execution in the server, which allows privilege escalation. The malicious JSP code can contain certain OS commands, through which an attacker can read sensitive files in the server, modify files or even delete contents in the server thus compromising the confidentiality, integrity and availability of the server hosting the SAP MII application. Also, an attacker authenticated as a developer can use the application to upload and execute a file which will permit them to execute operating systems commands completely compromising the server hosting the application.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 8.8 with network reachability and high EPSS, but exploitation requires an authenticated low-privileged developer and a role-holding user to open the dashboard.
What it is
SAP Manufacturing Integration and Intelligence (MII) lets users build dashboards and save them as JSP through the Self Service Composition Environment. An attacker can intercept a request and inject malicious JSP code that executes when a user with at least the SAP_XMII Developer role opens the dashboard. This yields remote code execution on the server hosting the application.
Impact
An attacker gains remote code execution on the SAP MII server, allowing reads of sensitive files, file modification or deletion, and full OS command execution. This compromises confidentiality, integrity and availability and enables privilege escalation.
Attack surface
Reached over the network via the SAP MII dashboard/SSCE request path; the CVSS vector shows low privileges required (PR:L) and no user interaction (UI:N), though the description notes a developer-role user must open the crafted dashboard for the payload to run.
Exploitation
Not listed in CISA KEV and no ransomware associations are documented. EPSS is high (0.50913, 98.9th percentile) and public references include Packet Storm and Full Disclosure postings, indicating public technical detail exists.
What to do
- Apply the SAP security note 3022622 fix and any related SAP MII patches as soon as possible.
- Restrict and review assignment of the SAP_XMII Developer role and other dashboard-authoring privileges.
- Validate and sanitize dashboard/JSP content on save and render; block untrusted JSP injection in SSCE requests.
- Segment the SAP MII server and limit outbound network and OS command execution paths from the application host.
- Monitor and alert on unexpected JSP files or dashboard artifacts written to the server.
Detection
- Monitor SAP MII/SSCE request logs for JSP code or OS command patterns in dashboard save or forward requests.
- Alert on creation or modification of JSP files in dashboard storage paths outside normal change windows.
- Track use of the SAP_XMII Developer role and dashboard publishing events for anomalous accounts or times.
- Watch for suspicious child processes spawned by the SAP MII application server (command shells, file utilities).
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://packetstormsecurity.com/files/163164/SAP-XMII-Remote-Code-Execution.html | Third Party AdvisoryVDB Entry |
| http://seclists.org/fulldisclosure/2021/Jun/30 | Mailing ListThird Party Advisory |
| https://launchpad.support.sap.com/#/notes/3022622 | Permissions RequiredVendor Advisory |
| https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107 | Vendor Advisory |
| https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html | Vendor Advisory |
| http://packetstormsecurity.com/files/163164/SAP-XMII-Remote-Code-Execution.html | Third Party AdvisoryVDB Entry |
| http://seclists.org/fulldisclosure/2021/Jun/30 | Mailing ListThird Party Advisory |
| https://launchpad.support.sap.com/#/notes/3022622 | Permissions RequiredVendor Advisory |
| https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107 | Vendor Advisory |
| https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html | Vendor Advisory |
Track CVE-2021-21480 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-21480), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
