SAP takes the security of its vast product portfolio very seriously and thus releases security fixes for
vulnerabilities reported by external researchers and their customers every second Tuesday of the month.
SAP Note 3002617
was released on
12.01.2021 and deals with
"[Multiple CVEs] Improper Input Validation in SAP 3D Visual Enterprise Viewer" within Visual Enterprise.
We advice you to follow the instructions, to resolve
denial of service (dos)
medium potential for exploitation
in component CA-VE-VEV.
According to SAP Security Advisory team a workaround does not exist. It is advisable to implement the correction as part of maintenance.
Denial of Service (DoS) attacks that take a system offline may lead to significant cost for the company, studies quantify the costs in average between 4 and 5 millions dollars. Business continuity requires SAP systems staying online. The CVSS scores or vulnerability descriptions are not enough to represent how a simple bug can lead to a significant loss for companies.
Risk specificationSAP 3D Visual Enterprise Viewer allows an authenticated attacker to crash the application by opening a specially crafted file, resulting in an denial of service.
The application now properly validated the input files, preventing this type of attack.
The advisory is valid for
- 9.8 Multiple Vulnerabilities in SAP Data Services
- 6.5 [CVE-2020-26826] Unrestricted File Upload vulnerability in SAP NetWeaver Application Server for Java (Process Integration Monitoring)
- 6.5 [CVE-2021-21488] Insecure deserialisation in SAP NetWeaver Knowledge Management
- 6.5 [CVE-2021-27603] Denial of Service (DoS) in SAP NetWeaver AS of ABAP
- 4.3 [Multiple CVEs] Improper Input Validation in SAP 3D Visual Enterprise Viewer