CVE-2021-27620

Published: Jun 9, 2021Modified: Nov 21, 2024

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value can submit a malicious IGS request over a network which due to insufficient input validation in method Ups::AddPart() which will trigger an internal memory corruption error in the system causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.

Affected (5)

Products: Sap: Netweaver As Internet Graphics Server

Sap

1 product

Netweaver As Internet Graphics Server

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Sap Netweaver As Internet Graphics Server	Version 7.20
Sap Netweaver As Internet Graphics Server	Version 7.20ex2
Sap Netweaver As Internet Graphics Server	Version 7.20ext
Sap Netweaver As Internet Graphics Server	Version 7.53
Sap Netweaver As Internet Graphics Server	Version 7.81