CVE-2021-27633

CWE-787 — Out-of-bounds WriteCWE-20 — Improper Input Validation3 documents3 sources
Severity
7.5HIGH
EPSS
0.3%
top 48.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
SAP SE SAP Netweaver AS FOR Abap (rfc Gateway)SAP Netweaver Abap
Timeline
PublishedJun 9
Latest updateMay 24

Description

SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73,7.77,7.81,7.82,7.83, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method ThCPIC() causing the system to crash and rendering it unavailable. In t…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5sap_se/sap_netweaver_as_for_abap_(rfc_gateway)< KRNL32NUC - 7.22+13
▶NVDsap/netweaver_abap16 versions+15

🔴Vulnerability Details

2
GHSA
GHSA-pqvr-m7xp-v679: SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7↗2022-05-24
▶
CVEList
CVE-2021-27633: SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7↗2021-06-09
▶
CVE-2021-27633 (HIGH CVSS 7.5) | SAP NetWeaver AS for ABAP (RFC Gate | cvebase.io