CVEvulnerability

CVE-2021-21465

9.9 CRITICAL Published 2021-01-12 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-01-12
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.9 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 3.0 ([email protected])
9.9 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-89

Description

The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the database will execute without properly sanitizing the untrusted data leading to SQL injection vulnerability which can fully compromise the affected SAP system.

Affected configurations

• sap business warehouse 710 • sap business warehouse 711 • sap business warehouse 730 • sap business warehouse 731 • sap business warehouse 740 • sap business warehouse 750 • sap business warehouse 751 • sap business warehouse 752 • sap business warehouse 753 • sap business warehouse 754 • sap business warehouse 755 • sap business warehouse 782

Related

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References