PT-2021-17563 · Sap · Sap Netweaver Abap Server+1

Published 2021-06-09 · Updated 2022-10-31 · CVE-2021-27628

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SAP NetWeaver ABAP Server and ABAP Platform (Dispatcher) versions 7.22 through 7.83

Description The issue allows an unauthenticated attacker to send a specially crafted packet over a network, triggering an internal error in the system due to improper input validation in the DpRTmPrepareReq() method. This causes the system to crash and become unavailable. The attack does not allow data in the system to be viewed or modified.

Recommendations For SAP NetWeaver ABAP Server and ABAP Platform (Dispatcher) versions 7.22 through 7.83, consider applying a patch or fix to address the improper input validation issue in the DpRTmPrepareReq() method to prevent system crashes. As a temporary workaround, consider restricting access to the system to minimize the risk of exploitation.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2021-27628

Affected Products

Abap Platform

Sap Netweaver Abap Server

References · 4

• https://osv.dev/vulnerability/CVE-2021-27628 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27628 · Security Note
• https://launchpad.support.sap.com/#/notes/3021197 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999 · Vendor Advisory