How severe is CVE-2021-27603?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in SAP Netweaver Application Server Abap

Q: What is CVE-2021-27603?

CVE-2021-27603 is a medium-severity vulnerability in SAP Netweaver Application Server Abap. CVSS score: 6.5/10. Published 2021-04-13.

CVE-2021-27603

An RFC enabled function module SPI_WAIT_MILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for any length of time. An attacker could call this function module multiple times to block all work processes thereby causing Denial of Service and affecting the Availability of the SAP system.

EPSS: 0.009 (54.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Affected products

Sap Netweaver_application_server_abap — versions 731, 740, 750
Sap Se Netweaver As For Abap — versions < 731, < 740, < 750

References

cna@sap.com (x_refsource_MISC, Vendor Advisory)
cna@sap.com (Permissions Required, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-27603?: CVE-2021-27603 is a medium-severity vulnerability in SAP Netweaver Application Server Abap. CVSS score: 6.5/10. Published 2021-04-13.
How severe is CVE-2021-27603?: Medium severity. CVSS v3 base score is 6.5 out of 10.