Patch days / February 2021

SAP Security Patch Day — February 2021

Tuesday, 9 February 2021

Vulnerabilities: 8
Critical: 1
High: 1
Zero-days: 0
Public exploit: 0

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 1

Critical 9.9
CVE-2021-21477 SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with th…
EPSS 30%

All vulnerabilities 8

Critical1 Show

Critical 9.9
CVE-2021-21477 SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with th…
EPSS 30%

High1 Show

High 8.1
CVE-2021-21479 Scanner template Remote Code Execution in SCIMono
EPSS 10%

Medium5 Show

Unscored1 Show

Unscored
CVE-2021-21474 SAP HANA Database, versions - 1.0, 2.0, accepts SAML tokens with MD5 digest, an attacker who manages to obtain an MD5-digest signed SAML Assertion issued for a…