CVE-2021-27624

MEDIUM

SAP Internet Graphics Service <=7.81 - Unauthenticated DoS via CiXMLIStreamRawBuffer::readRaw()

Title source: llm
STIX 2.1

Description

SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value can submit a malicious IGS request over a network which due to insufficient input validation in method CiXMLIStreamRawBuffer::readRaw () which will trigger an internal memory corruption error in the system causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.

References (2)

Core 2
Core References
Permissions Required, Vendor Advisory
https://launchpad.support.sap.com/#/notes/3021050

Scores

CVSS v3 5.9
EPSS 0.0051
EPSS Percentile 66.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-787
Status published
Products (5)
sap/netweaver_as_internet_graphics_server 7.20
sap/netweaver_as_internet_graphics_server 7.20ex2
sap/netweaver_as_internet_graphics_server 7.20ext
sap/netweaver_as_internet_graphics_server 7.53
sap/netweaver_as_internet_graphics_server 7.81
Published Jun 09, 2021
Tracked Since Feb 18, 2026