CVE-2021-27624 | Vulnetix

CVE-2021-27624 PUBLISHED CVSS 5.9 MEDIUM

Reported by sap · Published June 9, 2021

SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value can submit a malicious IGS request over a network which due to insufficient input validation in method CiXMLIStreamRawBuffer::readRaw () which will trigger an internal memory corruption error in the system causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.

Risk scores

CVSS 3.0

5.9

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Vendor	Product	Versions
SAP SE	SAP Internet Graphics Service	< 7.20, < 7.20EXT, < 7.53
SAP SE	SAP Internet Graphics Service	0, 0, 0

Timeline

Jun 8, 2021 CVE Published
Jun 10, 2021 EPSS Score (30 in total, the first dated here)
Oct 8, 2022 CVE Updated
Apr 4, 2026 Security Advisory
Aug 6, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2021-27624
vulnetix vdb fixes CVE-2021-27624

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2021-27624/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →