Remote Code Execution in SCIMono

CRITICAL 9.1CVE-2021-21479 · GHSA-29q4-gxjq-rx5c · Published 09/02/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
com.sap.scimono:scimono-server Maven	`< 0.0.19`	`0.0.19`
scimono sap	`< 0.0.19`	`0.0.19`

Description

Impact

It is possible for attacker to inject and execute java expression and compromising the availability and integrity of the system.

Patches

The issue was fixed on 0.0.19 version

NVD description

In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availability and integrity of the system.

References

SAP/scimono security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2021-21479 · ADVISORY
SAP/scimono commit 413b5d7 · WEB
mvnrepository.com/artifact/com.sap.scimono/scimono-server/0.0.19 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free