Security Experts:

Connect with us

Hi, what are you looking for?



SAP Patches Critical Flaws in MII, NetWeaver Products

SAP’s March 2021 Security Patch Day updates include 9 new security notes, including two for critical vulnerabilities affecting the company’s NetWeaver Application Server (AS) and Manufacturing Integration and Intelligence (MII) products.

SAP’s March 2021 Security Patch Day updates include 9 new security notes, including two for critical vulnerabilities affecting the company’s NetWeaver Application Server (AS) and Manufacturing Integration and Intelligence (MII) products.

This month’s set of patches also includes 4 updates to previously released Patch Day security notes, including updates for two notes rated Hot News (CVSS score 10), which address a missing authorization check in Solution Manager (CVE-2020-6207) and deliver the latest patches for the Chromium browser in Business Client.

The most severe of the newly released security notes addresses a code injection vulnerability in SAP MII. Tracked as CVE-2021-21480, the vulnerability features a CVSS score of 9.9.

Based on NetWeaver AS Java, SAP MII provides monitoring and data analysis capabilities, capturing data from production machinery and providing real-time information on performance and efficiency.

The critical vulnerability was identified in the Self-Service Composition Environment (SSCE) component, which allows the creation of dashboards (via drag-and-drop) that can be saved as JSP files. The flaw allows an attacker to inject malicious JSP code in a request to the server, which would then be executed when the infected dashboard is opened.

Exploitation of the bug would allow an attacker to access SAP databases and tamper with records, move laterally to other servers, inject malware, and modify network configurations to potentially compromise internal networks.

The second Hot News security note that SAP released on Tuesday addresses a missing authorization check in the Migration Service of NetWeaver AS Java (CVE-2021-21481, CVSS score 9.6).

Used internally to migrate applications between J2EE Engine releases, the service could be abused to gain administrative privileges and potentially fully compromise the vulnerable system. The fix for this vulnerability requires a system restart, Onapsis, a firm that specializes in securing SAP applications, explains.

This month, SAP released a single high-severity security note, to address a possible authentication bypass in HANA LDAP scenarios (CVE-2021-21484, CVSS score 7.7). Successful exploitation requires that the LDAP directory server enables unauthenticated bind and that SAP HANA has been configured to automatically create users and allow access based on LDAP authentication.

All of the remaining security notes included in the March 2021 Security Patch Day are rated medium severity. They address missing authorization checks, an insecure deserialization issue, a reverse TabNabbing vulnerability, improper input validation, and a server-side request forgery bug.

Related: Critical Vulnerability Patched in SAP Commerce Product

Related: Scanning Activity Detected After Release of Exploit for Critical SAP SolMan Flaw

Related: SAP Patches Serious Code Injection, DoS Vulnerabilities

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Expert Insights

Related Content

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.


Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.


Several vulnerabilities have been patched in OpenText’s enterprise content management (ECM) product.


Google has awarded more than $25,000 to the researchers who reported the vulnerabilities patched with the release of the latest Chrome update.