CVE-2021-27618 File upload in SAP Process Integration (Integration Builder Framework)
Attackers can upload malicious files due to missing extension checks, causing denial of service in SAP Process Integration.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-27618?
CVE-2021-27618 is a medium-severity vulnerability in SAP Process Integration (Integration Builder Framework), published on 11 May 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not check the file type extension of the file uploaded from local source. An attacker could craft a malicious file and upload it to the application, which could lead to denial of service and impact the availability of the application.
Weakness: CWE-434
Which versions are affected by CVE-2021-27618?
It affects 1 product.
Products include Sap Netweaver Process Integration.
How do I fix CVE-2021-27618?
No fix has been published for CVE-2021-27618 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-27618 being exploited?
There is no known exploitation of CVE-2021-27618 in the wild and no public exploit code.
Other vulnerabilities in SAP Process Integration (Integration Builder Framework)
- CVE-2022-41272 Missing authorization in NetWeaver Process Integration
- CVE-2022-41271 SQL injection in NetWeaver Process Integration
- CVE-2021-27604 XML external entity in SAP Process Integration (Enterprise Service Repository JAVA Mappings)
- CVE-2019-0315 Information disclosure in SAP NetWeaver Process Integration(SAP XIESR)
- CVE-2019-0328 Command injection in SAP NetWeaver Process Integration ABAP tests (SAP Basis)
Sources
Also known as GHSA-fq48-p44p-fxj5.