Vulnerability · Published Jan 12, 2021 · Assigned by sap
CVE-2021-21468
Medium 6.5
In plain English
A medium-severity security flaw in SAP Business Warehouse from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities).
Severity (CVSS 3.0)6.5Medium
Exploit odds (30 days)1.9%top 20.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges that allows the user to practically read out any database table.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP Business Warehouse | < 710< 711< 730< 731< 740< 750< 751< 752 |
References
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476 x_refsource_MISC
- https://launchpad.support.sap.com/#/notes/2986980 x_refsource_MISC
- 20220518 SEC Consult SA-20220518-0 :: Multiple Critical Vulnerabilities in SAP Application Server, ABAP and ABAP Platform (Different Software Components) mailing-list, x_refsource_FULLDISC
- http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html x_refsource_MISC