Remote Code Execution in SCIMono

CRÍTICO 9.1CVE-2021-21479 · GHSA-29q4-gxjq-rx5c · Published 09/02/2021 · updated 17/06/2026

En resumen

CVE-2021-21479 es una vulnerabilidad CRÍTICO (CVSS 9.1) que afecta a com.sap.scimono:scimono-server, scimono (sap).
Probabilidad de explotación en los próximos 30 días (EPSS): 10.1%, mayor que el 95.6% de las vulnerabilidades.
Solución: actualizar a 0.0.19 o posterior.

Package	Affected versions	Patched versions
com.sap.scimono:scimono-server Maven	`< 0.0.19`	`0.0.19`
scimono sap	`< 0.0.19`	`0.0.19`

Description

Impact

It is possible for attacker to inject and execute java expression and compromising the availability and integrity of the system.

Patches

The issue was fixed on 0.0.19 version

NVD description

In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availability and integrity of the system.

References

SAP/scimono security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2021-21479 · ADVISORY
SAP/scimono commit 413b5d7 · WEB
mvnrepository.com/artifact/com.sap.scimono/scimono-server/0.0.19 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free