5.9
CVE-2021-27622
- EPSS 0.51%
- Veröffentlicht 09.06.2021 14:15:08
- Zuletzt bearbeitet 21.11.2024 05:58:19
- Quelle cna@sap.com
- Teams Watchlist Login
- Unerledigt Login
SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value can submit a malicious IGS request over a network which due to insufficient input validation in method CDrawRaster::LoadImageFromMemory() which will trigger an internal memory corruption error in the system causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
SAP ≫ Netweaver As Internet Graphics Server Version7.20
SAP ≫ Netweaver As Internet Graphics Server Version7.20ex2
SAP ≫ Netweaver As Internet Graphics Server Version7.20ext
SAP ≫ Netweaver As Internet Graphics Server Version7.53
SAP ≫ Netweaver As Internet Graphics Server Version7.81
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.51% | 0.635 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.9 | 2.2 | 3.6 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
|
| nvd@nist.gov | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:N/A:P
|
| cna@sap.com | 5.9 | 2.2 | 3.6 |
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
|
CWE-787 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.