CVE-2021-27617 Denial of service in SAP Process Integration (Integration Builder Framework)

Medium 4.9 Published 11 May 2021 Updated 3 Aug 2024

An attacker can cause denial of service in SAP Process Integration by uploading a malicious XML document that consumes excessive system memory.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-27617?

CVE-2021-27617 is a medium-severity denial of service vulnerability in SAP Process Integration (Integration Builder Framework), published on 11 May 2021. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document uploaded from local source. An attacker can craft a malicious XML which when uploaded and parsed by the application, could lead to Denial-of-service conditions due to consumption of a large amount of system memory, thus highly impacting system availability.

Weakness: CWE-20

Which versions are affected by CVE-2021-27617?

It affects 1 product.

Products include Sap Netweaver Process Integration.

How do I fix CVE-2021-27617?

No fix has been published for CVE-2021-27617 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-27617 being exploited?

There is no known exploitation of CVE-2021-27617 in the wild and no public exploit code.

Sources

Also known as GHSA-j8m5-m975-227f.