VulnerabilityModified
CVE-2021-27603
An RFC enabled function module SPI_WAIT_MILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for any length of time.
MEDIUM 6.5EPSS 0.86%
Does this matter?
Lower severity and a low EPSS score (0.86%). Track it; it rarely justifies an emergency change on its own.
Description
An RFC enabled function module SPI_WAIT_MILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for any length of time. An attacker could call this function module multiple times to block all work processes thereby causing Denial of Service and affecting the Availability of the SAP system.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.86% probability · 57th percentile
- CISA KEV
- Not listed
- Affected
- sap/netweaver application server abap
- Source
- cna@sap.com
References
- https://launchpad.support.sap.com/#/notes/3028729Permissions Required
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649Vendor Advisory
- https://launchpad.support.sap.com/#/notes/3028729Permissions Required
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.