CVE-2021-33684: sap_se sap netweaver as abap and abap platform Out-of-bounds Write

Vulnerability summary

CVE-2021-33684 is a medium (CVSS 5.3) Out-of-bounds Write vulnerability in sap_se sap netweaver as abap and abap platform. EPSS estimates a 0.98% chance of exploitation in the next 30 days, higher than 61.9% of scored vulnerabilities.

Timeline

1. 14-07-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

SAP NetWeaver AS ABAP and ABAP Platform, versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 8.04, 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 8.04, 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.77, 7.81, 7.84, allows an attacker to send overlong content in the RFC request type thereby crashing the corresponding work process because of memory corruption vulnerability. The work process will attempt to restart itself after the crash and hence the impact on the availability is low.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.