CVE-2021-27631 — Vulnetix

CVE-2021-27631 PUBLISHED CVSS 7.5 HIGH

SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method EnqConvUniToSrvReq() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.

EPSS 0.32% · 55.7th percentile

Risk Scores

CVSS v3.0

7.5

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score

0.32%

55.7th percentile

Affected Products

Vendor	Product	Versions
SAP SE	SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server)	< KRNL32NUC - 7.22, < 7.22EXT, < 7.22
sap	netweaver_as_abap	kernel_7.49, kernel_7.53, kernel_7.73

Timeline

Jun 8, 2021 CVE Published
Jun 10, 2021 EPSS Score
Aug 11, 2021 EPSS Score
Oct 10, 2021 EPSS Score
Dec 10, 2021 EPSS Score
Feb 4, 2022 EPSS Score
Feb 9, 2022 EPSS Score
Apr 1, 2022 EPSS Score
Apr 11, 2022 EPSS Score
Jun 10, 2022 EPSS Score
Aug 11, 2022 EPSS Score
Oct 11, 2022 EPSS Score

References

Open in Interactive Console →