SapCVELIST:CVE-2021-27635CVE-2021-27635
9 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H
6.4 Medium
AI Score
Confidence
High
0.003 Low
EPSS
Percentile
71.4%
SAP NetWeaver AS for JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker authenticated as an administrator to connect over a network and submit a specially crafted XML file in the application because of missing XML Validation, this vulnerability enables attacker to fully compromise confidentiality by allowing them to read any file on the filesystem or fully compromise availability by causing the system to crash. The attack cannot be used to change any data so that there is no compromise as to integrity.
CNA Affected
[
{
"product": "SAP NetWeaver AS for JAVA",
"vendor": "SAP SE",
"versions": [
{
"status": "affected",
"version": "< 7.20"
},
{
"status": "affected",
"version": "< 7.30"
},
{
"status": "affected",
"version": "< 7.31"
},
{
"status": "affected",
"version": "< 7.40"
},
{
"status": "affected",
"version": "< 7.50"
}
]
}
]Related
9 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H
6.4 Medium
AI Score
Confidence
High
0.003 Low
EPSS
Percentile
71.4%