SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow a low privileged attacker to inject code using a remote enabled function module over the network. Via the function module an attacker can create a malicious ABAP report which could be used to get access to sensitive data, to inject malicious UPDATE statements that could have also impact on the operating system, to disrupt the functionality of the SAP system which can thereby lead to a Denial of Service.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html | Exploit Third Party Advisory VDB Entry |
| http://seclists.org/fulldisclosure/2022/May/42 | Exploit Mailing List Third Party Advisory |
| https://launchpad.support.sap.com/#/notes/2999854 | Permissions Required Vendor Advisory |
| https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
01 Oct 2022, 02:03
| Type | Values Removed | Values Added |
|---|---|---|
| References | (FULLDISC) http://seclists.org/fulldisclosure/2022/May/42 - Exploit, Mailing List, Third Party Advisory | |
| References | (MISC) http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html - Exploit, Third Party Advisory, VDB Entry |
19 May 2022, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
19 May 2022, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
23 Jun 2021, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
17 May 2021, 19:59
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://launchpad.support.sap.com/#/notes/2999854 - Permissions Required, Vendor Advisory |
13 May 2021, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
14 Jan 2021, 15:47
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:sap:business_warehouse:702:*:*:*:*:*:*:* cpe:2.3:a:sap:business_warehouse:750:*:*:*:*:*:*:* cpe:2.3:a:sap:business_warehouse:711:*:*:*:*:*:*:* cpe:2.3:a:sap:bw\/4hana:200:*:*:*:*:*:*:* cpe:2.3:a:sap:business_warehouse:730:*:*:*:*:*:*:* cpe:2.3:a:sap:business_warehouse:731:*:*:*:*:*:*:* cpe:2.3:a:sap:business_warehouse:782:*:*:*:*:*:*:* cpe:2.3:a:sap:business_warehouse:740:*:*:*:*:*:*:* cpe:2.3:a:sap:business_warehouse:701:*:*:*:*:*:*:* cpe:2.3:a:sap:bw\/4hana:100:*:*:*:*:*:*:* cpe:2.3:a:sap:business_warehouse:700:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : 6.5
v3 : 8.8 |
| References | (MISC) https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476 - Vendor Advisory | |
| References | (MISC) https://i7p.wdf.sap.corp/sap/support/notes/2999854 - Broken Link | |
| CWE | CWE-94 |
12 Jan 2021, 15:38
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-01-12 15:15
Updated : 2023-12-10 13:41
NVD link : CVE-2021-21466
Mitre link : CVE-2021-21466
CVE.ORG link : CVE-2021-21466
JSON object : View
Products Affected
sap
- bw\/4hana
- business_warehouse
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')