Memory Corruption Vulnerability in SAP Internet Graphics Service

CVE-2021-27620

Summary

The SAP Internet Graphics Service is susceptible to a memory corruption vulnerability due to insufficient input validation in the Ups::AddPart() method. An unauthenticated attacker can exploit this flaw after retrieving an existing system state value, allowing them to submit a crafted IGS request over the network. This can lead to internal memory corruption, resulting in a crash of the service and making the system unavailable. During this attack, the attacker cannot access or modify any data within the system.

References