CVE-2021-21479

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-02-09 · updated 2026-06-17
Weakness: CWE-74

Description

In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availability and integrity of the system.

Affected products

SAP SE SCIMono: before 0.0.19 — fixed in 0.0.19

How to fix

Upgrade to a fixed version: SAP SE SCIMono 0.0.19. Check the vendor advisory for mitigations.

References

https://github.com/SAP/scimono/security/advisories/GHSA-29q4-gxjq-rx5c
https://github.com/SAP/scimono/security/advisories/GHSA-29q4-gxjq-rx5c

Get alerted when CVE-2021-21479 or the next vulnerability affects your stack