Vulnerabilities > CVE-2021-27631 - NULL Pointer Dereference vulnerability in SAP Netweaver AS Abap

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

sap

CWE-476

NVD

Published: 2021-06-09

Updated: 2022-10-31

Summary

SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method EnqConvUniToSrvReq() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.

Vulnerable Configurations

Part	Description	Count
Application	Sap SAP Netweaver AS Abap Krnl32Nuc_7.22 SAP Netweaver AS Abap Krnl32Nuc_7.22Ext SAP Netweaver AS Abap Krnl64Nuc_7.22 SAP Netweaver AS Abap Krnl64Nuc_7.22Ext SAP Netweaver AS Abap Krnl64Nuc_7.49 SAP Netweaver AS Abap Krnl64Uc_8.04 SAP Netweaver AS Abap Kernel_7.22 SAP Netweaver AS Abap Kernel_7.49 SAP Netweaver AS Abap Kernel_8.04 SAP Netweaver AS Abap Krnl64Uc_7.22 SAP Netweaver AS Abap Krnl64Uc_7.22Ext SAP Netweaver AS Abap Krnl64Uc_7.49 SAP Netweaver AS Abap Krnl64Uc_7.53 SAP Netweaver AS Abap Krnl64Uc_7.73 SAP Netweaver AS Abap Kernel_7.53 SAP Netweaver AS Abap Kernel_7.73 SAP Netweaver AS Abap Kernel_7.77 SAP Netweaver AS Abap Kernel_7.81 SAP Netweaver AS Abap Kernel_7.82 SAP Netweaver AS Abap Kernel_7.83	20

Common Weakness Enumeration (CWE)

CWE-476 - NULL Pointer Dereference

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References