CVE-2021-27599 Information disclosure in SAP Process Integration (Integration Builder Framework)
An attacker can access restricted information in SAP NetWeaver ABAP Server's Integration Builder Framework under certain conditions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-27599?
CVE-2021-27599 is a medium-severity vulnerability in SAP Process Integration (Integration Builder Framework), published on 14 Apr 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Integration Builder Framework), versions - 7.10, 7.30, 7.31, 7.40, 7.50, allows an attacker to access information under certain conditions, which would otherwise be restricted.
Which versions are affected by CVE-2021-27599?
It affects 1 product.
Products include Sap Netweaver Process Integration.
How do I fix CVE-2021-27599?
No fix has been published for CVE-2021-27599 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-27599 being exploited?
There is no known exploitation of CVE-2021-27599 in the wild and no public exploit code.
Other vulnerabilities in SAP Process Integration (Integration Builder Framework)
- CVE-2022-41272 Missing authorization in NetWeaver Process Integration
- CVE-2022-41271 SQL injection in NetWeaver Process Integration
- CVE-2021-27604 XML external entity in SAP Process Integration (Enterprise Service Repository JAVA Mappings)
- CVE-2019-0315 Information disclosure in SAP NetWeaver Process Integration(SAP XIESR)
- CVE-2019-0328 Command injection in SAP NetWeaver Process Integration ABAP tests (SAP Basis)
Sources
Also known as GHSA-x48c-g5j2-gv88.