CVE-2021-21465

published 2021-01-12

CVE-2021-21465: The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can…

Priority P2 66 critical 9.9 CVSS 3.1

AV N AC L PR L UI N S C C H I H A H

The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the database will execute without properly sanitizing the untrusted data leading to SQL injection vulnerability which can fully compromise the affected SAP system.

Affected

24 ranges

Vendor	Product	Version range	Fixed in
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap_se	sap_business_warehouse	< 710	710
sap_se	sap_business_warehouse	< 711	711
sap_se	sap_business_warehouse	< 730	730
sap_se	sap_business_warehouse	< 731	731
sap_se	sap_business_warehouse	< 740	740
sap_se	sap_business_warehouse	< 750	750
sap_se	sap_business_warehouse	< 751	751
sap_se	sap_business_warehouse	< 752	752
sap_se	sap_business_warehouse	< 753	753
sap_se	sap_business_warehouse	< 754	754
sap_se	sap_business_warehouse	< 755	755
sap_se	sap_business_warehouse	< 782	782

CVSS provenance

nvd v3.1 9.9 CRITICAL CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

nvd v3.0 9.9 CRITICAL CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89