Log in Start free

Vulnerability · Published Jan 12, 2021 · Assigned by sap

CVE-2021-21466

Critical 9.9

In plain English

A critical-severity security flaw in SAP Business Warehouse from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.1% (higher than 88% of all known vulnerabilities).

Severity (CVSS 3.0)9.9Critical
Exploit odds (30 days)3.1%top 12.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow a low privileged attacker to inject code using a remote enabled function module over the network. Via the function module an attacker can create a malicious ABAP report which could be used to get access to sensitive data, to inject malicious UPDATE statements that could have also impact on the operating system, to disrupt the functionality of the SAP system which can thereby lead to a Denial of Service.

Affected products (as reported)

VendorProductVersions
SAP SE SAP Business Warehouse < 700< 701< 702< 711< 730< 731< 740< 750
SAP SE SAP BW/4HANA < 100< 200

References