CVE-2021-27632

moderate-risk

Published 2021-06-09

SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method EnqConvUniToSrvReq() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.

Do I need to act?

0.32% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (20)

Netweaver As Abap

Affected Vendors

Sap

References (4)

Permissions Required https://launchpad.support.sap.com/#/notes/3020104

Broken Link https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999

Permissions Required https://launchpad.support.sap.com/#/notes/3020104

Broken Link https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 1/34 · Minimal

Exposure 20/34 · Moderate