CVE-2021-27603

published 2021-04-13

CVE-2021-27603: An RFC enabled function module SPI_WAIT_MILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for any length of time…

Priority P4 32 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C N I N A H

An RFC enabled function module SPI_WAIT_MILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for any length of time. An attacker could call this function module multiple times to block all work processes thereby causing Denial of Service and affecting the Availability of the SAP system.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
sap	netweaver_application_server_abap	—	—
sap	netweaver_application_server_abap	—	—
sap	netweaver_application_server_abap	—	—
sap_se	sap_netweaver_as_for_abap	< 731	731
sap_se	sap_netweaver_as_for_abap	< 740	740
sap_se	sap_netweaver_as_for_abap	< 750	750

CVSS provenance

nvd v3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

nvd v3.0 6.5 MEDIUM CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

nvd v2.0 4.0 MEDIUM AV:N/AC:L/Au:S/C:N/I:N/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.