CVE-2021-27603
Last modified
CVE-2021-27603 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. An RFC enabled function module SPI_WAIT_MILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for any length of time. An attacker could call this function module multiple times to block all work processes thereby causing Denial of Service and affecting the Availability of the SAP system.. EPSS estimates a 0.86% chance of exploitation in the next 30 days.
Description
An RFC enabled function module SPI_WAIT_MILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for any length of time. An attacker could call this function module multiple times to block all work processes thereby causing Denial of Service and affecting the Availability of the SAP system.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sap | Netweaver Application Server Abap | 731 |
| Sap | Netweaver Application Server Abap | 740 |
| Sap | Netweaver Application Server Abap | 750 |
References
- https://launchpad.support.sap.com/#/notes/3028729Permissions Required
- https://launchpad.support.sap.com/#/notes/3028729Permissions Required
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-27603?
How severe is CVE-2021-27603?
How do I fix CVE-2021-27603?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-27597SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NU…7.5
- CVE-2021-27598SAP NetWeaver AS JAVA (Customer Usage Provisioning Servlet),…5.3
- CVE-2021-27599SAP NetWeaver ABAP Server and ABAP Platform (Process Integra…6.5
- CVE-2021-27600SAP Manufacturing Execution (System Rules), versions - 15.1,…5.4
- CVE-2021-27601SAP NetWeaver AS Java (Applications based on HTMLB for Java)…5.4
- CVE-2021-27602SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backo…9.9
- CVE-2021-27604In order to prevent XML External Entity vulnerability in SAP…6.5
- CVE-2021-27605SAP's HCM Travel Management Fiori Apps V2, version - 608, do…4.3
- CVE-2021-27606SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server)…7.5
- CVE-2021-27607SAP NetWeaver ABAP Server and ABAP Platform (Dispatcher), ve…7.5
- CVE-2021-27608An unquoted service path in SAPSetup, version - 9.0, could l…7.5
- CVE-2021-27609SAP Focused RUN versions 200, 300, does not perform necessar…6.5
Are you affected by CVE-2021-27603?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST