CVE-2021-27618

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-05-11 · updated 2026-06-17
Weakness: CWE-434

Description

The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not check the file type extension of the file uploaded from local source. An attacker could craft a malicious file and upload it to the application, which could lead to denial of service and impact the availability of the application.

Affected products

SAP SE SAP Process Integration (Integration Builder Framework): 7.10, 7.11, 7.20, 7.30, 7.31, 7.40 (+1)

References

https://launchpad.support.sap.com/#/notes/3012021
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=576094655
https://launchpad.support.sap.com/#/notes/3012021
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=576094655

Get alerted when CVE-2021-27618 or the next vulnerability affects your stack