Vulnerability · Published Jan 12, 2021 · Assigned by sap
CVE-2021-21465
Critical 9.9
In plain English
A critical-severity security flaw in SAP Business Warehouse from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.7% (higher than 90% of all known vulnerabilities).
Severity (CVSS 3.0)9.9Critical
Exploit odds (30 days)3.7%top 10.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the database will execute without properly sanitizing the untrusted data leading to SQL injection vulnerability which can fully compromise the affected SAP system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP Business Warehouse | < 710< 711< 730< 731< 740< 750< 751< 752 |
References
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476 x_refsource_MISC
- https://launchpad.support.sap.com/#/notes/2986980 x_refsource_MISC
- 20220518 SEC Consult SA-20220518-0 :: Multiple Critical Vulnerabilities in SAP Application Server, ABAP and ABAP Platform (Different Software Components) mailing-list, x_refsource_FULLDISC
- http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html x_refsource_MISC