CVE-2021-27620: SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value…

PriorityP431medium5.9CVSS 3.1

AVNACHPRNUINSUCNINAH

EPSS

1.21%

64.8th percentile

SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value can submit a malicious IGS request over a network which due to insufficient input validation in method Ups::AddPart() which will trigger an internal memory corruption error in the system causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
sap	netweaver_as_internet_graphics_server	—	—
sap	netweaver_as_internet_graphics_server	—	—
sap	netweaver_as_internet_graphics_server	—	—
sap	netweaver_as_internet_graphics_server	—	—
sap	netweaver_as_internet_graphics_server	—	—
sap_se	sap_internet_graphics_service	< 7.20	7.20
sap_se	sap_internet_graphics_service	< 7.20EXT	7.20EXT
sap_se	sap_internet_graphics_service	< 7.53	7.53
sap_se	sap_internet_graphics_service	< 7.20_EX2	7.20_EX2
sap_se	sap_internet_graphics_service	< 7.81	7.81

CVSS provenance

nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

nvdv3.05.9MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.