Log in Start free

Vulnerability · Published Jun 9, 2021 · Assigned by sap

CVE-2021-27635

Critical 9.0

In plain English

A critical-severity security flaw in SAP NetWeaver AS for JAVA from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities).

Severity (CVSS 3.0)9.0Critical
Exploit odds (30 days)1.6%top 24.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

SAP NetWeaver AS for JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker authenticated as an administrator to connect over a network and submit a specially crafted XML file in the application because of missing XML Validation, this vulnerability enables attacker to fully compromise confidentiality by allowing them to read any file on the filesystem or fully compromise availability by causing the system to crash. The attack cannot be used to change any data so that there is no compromise as to integrity.

Affected products (as reported)

VendorProductVersions
SAP SE SAP NetWeaver AS for JAVA < 7.20< 7.30< 7.31< 7.40< 7.50

References