Memory Corruption Vulnerability in SAP Internet Graphics Service
CVE-2021-27623

5.9MEDIUM

Key Information:

Vendor
SAP
Status
SAP Internet Graphics Service
Vendor
CVE Published:
9 June 2021

Summary

The vulnerability in SAP Internet Graphics Service allows an unauthenticated attacker to exploit insufficient input validation in the CXmlUtility::CheckLength() method, leading to a memory corruption error. By submitting a crafted IGS request over the network after retrieving an existing system state value, the attacker can cause the system to crash, resulting in downtime and unavailability. This issue does not allow for data viewing or modification within the system.

Affected Version(s)

SAP Internet Graphics Service < 7.20 < 7.20

SAP Internet Graphics Service < 7.20EXT < 7.20EXT

SAP Internet Graphics Service < 7.53 < 7.53

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
https://launchpad.support.sap.com/#/notes/3021050

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.