PT-2021-17552 · Sap · Sap Process Integration

Published 2021-05-11 · Updated 2021-08-27 · CVE-2021-27617

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SAP Process Integration versions 7.10 through 7.50

Description The issue arises from insufficient validation of an XML document uploaded from a local source by the Integration Builder Framework. This can be exploited by an attacker crafting a malicious XML document. When the application uploads and parses this document, it could lead to denial-of-service conditions due to excessive system memory consumption, significantly impacting system availability.

Recommendations For versions 7.10 through 7.50, update the Integration Builder Framework to a version that properly validates XML documents uploaded from local sources to prevent denial-of-service conditions.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2021-27617

Affected Products

Sap Process Integration

References · 4

• https://osv.dev/vulnerability/CVE-2021-27617 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27617 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=576094655 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3012021 · Vendor Advisory