description: SAP NetWeaver AS ABAP and ABAP Platform, versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 8.04, 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 8.04, 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.77, 7.81, 7.84, allows an attacker to send overlong content in the RFC request type thereby crashing the corresponding work process because of memory corruption vulnerability. The work process will attempt to restart itself after the crash and hence the impact on the availability is low.
problem types: Memory Corruption (CWE-787)
affected:
{
product: SAP NetWeaver AS ABAP and ABAP Platform
vendor: SAP SE
versions:
status: affected, version: < KRNL32NUC 7.21
status: affected, version: < 7.21EXT
status: affected, version: < 7.22
status: affected, version: < 7.22EXT
status: affected, version: < KRNL32UC 7.21
status: affected, version: < KRNL64NUC 7.21
status: affected, version: < 7.49
status: affected, version: < KRNL64UC 8.04
status: affected, version: < 7.21
status: affected, version: < 7.53
status: affected, version: < KERNEL 8.04
status: affected, version: < 7.77
status: affected, version: < 7.81
status: affected, version: < 7.84
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.0
]