CVE-2021-27628: Input Validation
SAP NetWeaver ABAP Server and ABAP Platform (Dispatcher), versions - KRNL32NUC - 7.22,7.22EXT, KRNL32UC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73,7.77,7.81,7.82,7.83, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method DpRTmPrepareReq() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-27628?
The severity of CVE-2021-27628 is high, with a severity value of 7.5.
How does CVE-2021-27628 affect SAP NetWeaver ABAP Server and ABAP Platform?
CVE-2021-27628 affects SAP NetWeaver ABAP Server and ABAP Platform by allowing an unauthenticated attacker without specific user credentials to execute remote code on the affected systems.
Which versions of SAP NetWeaver AS ABAP are affected by CVE-2021-27628?
CVE-2021-27628 affects SAP NetWeaver AS ABAP versions: kernel_7.22, kernel_7.49, kernel_7.53, kernel_7.73, kernel_7.77, kernel_7.81, kernel_7.82, kernel_7.83, and kernel_8.04.
How can an attacker exploit CVE-2021-27628?
An attacker can exploit CVE-2021-27628 by sending a specially crafted request to the affected SAP NetWeaver ABAP Server or ABAP Platform, leading to the execution of remote code.
Are there any available patches or fixes for CVE-2021-27628?
Yes, SAP has released patches and fixes to address CVE-2021-27628. It is recommended to apply the necessary updates as soon as possible.