Lucene search

SapCVE-2021-27597

HistoryJun 09, 2021 - 2:15 p.m.

CVE-2021-27597

2021-06-0914:15:08

CWE-125

sap

web.nvd.nist.gov

sap

netweaver

abap

rfc gateway

cve-2021-27597

security vulnerability

unauthenticated attacker

improper input validation

system crash

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

44.1%

JSON

SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73,7.77,7.81,7.82,7.83, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method memmove() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.

Affected configurations

Nvd

Node

sapnetweaver_abapMatchkernel_7.22

sapnetweaver_abapMatchkernel_7.49

sapnetweaver_abapMatchkernel_7.53

sapnetweaver_abapMatchkernel_7.73

sapnetweaver_abapMatchkernel_8.04

sapnetweaver_abapMatchkrnl32nuc_7.22

sapnetweaver_abapMatchkrnl32nuc_7.22ext

sapnetweaver_abapMatchkrnl64nuc_7.22

sapnetweaver_abapMatchkrnl64nuc_7.22ext

sapnetweaver_abapMatchkrnl64nuc_7.49

sapnetweaver_abapMatchkrnl64uc_7.22

sapnetweaver_abapMatchkrnl64uc_7.22ext

sapnetweaver_abapMatchkrnl64uc_7.49

sapnetweaver_abapMatchkrnl64uc_7.53

sapnetweaver_abapMatchkrnl64uc_7.73

sapnetweaver_abapMatchkrnl64uc_8.04

VendorProductVersionCPE
sapnetweaver_abapkernel_7.22cpe:2.3:a:sap:netweaver_abap:kernel_7.22:*:*:*:*:*:*:*
sapnetweaver_abapkernel_7.49cpe:2.3:a:sap:netweaver_abap:kernel_7.49:*:*:*:*:*:*:*
sapnetweaver_abapkernel_7.53cpe:2.3:a:sap:netweaver_abap:kernel_7.53:*:*:*:*:*:*:*
sapnetweaver_abapkernel_7.73cpe:2.3:a:sap:netweaver_abap:kernel_7.73:*:*:*:*:*:*:*
sapnetweaver_abapkernel_8.04cpe:2.3:a:sap:netweaver_abap:kernel_8.04:*:*:*:*:*:*:*
sapnetweaver_abapkrnl32nuc_7.22cpe:2.3:a:sap:netweaver_abap:krnl32nuc_7.22:*:*:*:*:*:*:*
sapnetweaver_abapkrnl32nuc_7.22extcpe:2.3:a:sap:netweaver_abap:krnl32nuc_7.22ext:*:*:*:*:*:*:*
sapnetweaver_abapkrnl64nuc_7.22cpe:2.3:a:sap:netweaver_abap:krnl64nuc_7.22:*:*:*:*:*:*:*
sapnetweaver_abapkrnl64nuc_7.22extcpe:2.3:a:sap:netweaver_abap:krnl64nuc_7.22ext:*:*:*:*:*:*:*
sapnetweaver_abapkrnl64nuc_7.49cpe:2.3:a:sap:netweaver_abap:krnl64nuc_7.49:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sap	netweaver_abap	kernel_7.22	cpe:2.3:a:sap:netweaver_abap:kernel_7.22:::::::*
sap	netweaver_abap	kernel_7.49	cpe:2.3:a:sap:netweaver_abap:kernel_7.49:::::::*
sap	netweaver_abap	kernel_7.53	cpe:2.3:a:sap:netweaver_abap:kernel_7.53:::::::*
sap	netweaver_abap	kernel_7.73	cpe:2.3:a:sap:netweaver_abap:kernel_7.73:::::::*
sap	netweaver_abap	kernel_8.04	cpe:2.3:a:sap:netweaver_abap:kernel_8.04:::::::*
sap	netweaver_abap	krnl32nuc_7.22	cpe:2.3:a:sap:netweaver_abap:krnl32nuc_7.22:::::::*
sap	netweaver_abap	krnl32nuc_7.22ext	cpe:2.3:a:sap:netweaver_abap:krnl32nuc_7.22ext:::::::*
sap	netweaver_abap	krnl64nuc_7.22	cpe:2.3:a:sap:netweaver_abap:krnl64nuc_7.22:::::::*
sap	netweaver_abap	krnl64nuc_7.22ext	cpe:2.3:a:sap:netweaver_abap:krnl64nuc_7.22ext:::::::*
sap	netweaver_abap	krnl64nuc_7.49	cpe:2.3:a:sap:netweaver_abap:krnl64nuc_7.49:::::::*

Rows per page:

1-10 of 161

CNA Affected

[
  {
    "vendor": "SAP SE",
    "product": "SAP NetWeaver AS for ABAP (RFC Gateway)",
    "versions": [
      {
        "version": "< KRNL32NUC - 7.22",
        "status": "affected"
      },
      {
        "version": "< 7.22EXT",
        "status": "affected"
      },
      {
        "version": "< KRNL64NUC - 7.22",
        "status": "affected"
      },
      {
        "version": "< 7.49",
        "status": "affected"
      },
      {
        "version": "< KRNL64UC - 8.04",
        "status": "affected"
      },
      {
        "version": "< 7.22",
        "status": "affected"
      },
      {
        "version": "< 7.53",
        "status": "affected"
      },
      {
        "version": "< 7.73",
        "status": "affected"
      },
      {
        "version": "< KERNEL - 7.22",
        "status": "affected"
      },
      {
        "version": "< 8.04",
        "status": "affected"
      },
      {
        "version": "< 7.77",
        "status": "affected"
      },
      {
        "version": "< 7.81",
        "status": "affected"
      },
      {
        "version": "< 7.82",
        "status": "affected"
      },
      {
        "version": "< 7.83",
        "status": "affected"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/3020209

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

44.1%

JSON

Related for CVE-2021-27597