Vulnerability Details : CVE-2021-27617
The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document uploaded from local source. An attacker can craft a malicious XML which when uploaded and parsed by the application, could lead to Denial-of-service conditions due to consumption of a large amount of system memory, thus highly impacting system availability.
Vulnerability category: Input validationDenial of service
Products affected by CVE-2021-27617
- cpe:2.3:a:sap:netweaver_process_integration:7.11:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_process_integration:7.30:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_process_integration:7.31:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_process_integration:7.40:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_process_integration:7.10:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_process_integration:7.50:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_process_integration:7.20:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-27617
0.09%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 35 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-27617
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:N/I:N/A:P |
8.0
|
2.9
|
NIST | |
4.9
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H |
1.2
|
3.6
|
SAP SE | |
4.9
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H |
1.2
|
3.6
|
NIST |
CWE ids for CVE-2021-27617
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2021-27617
-
https://launchpad.support.sap.com/#/notes/3012021
SAP ONE Support Launchpad: Log OnPermissions Required;Vendor Advisory
-
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=576094655
SAP Security Patch Day – May 2021 - Product Security Response at SAP - Community WikiVendor Advisory
Jump to