CVE-2021-21466

published 2021-01-12

CVE-2021-21466: SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow a low privileged attacker to inject…

Priority P3 55 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow a low privileged attacker to inject code using a remote enabled function module over the network. Via the function module an attacker can create a malicious ABAP report which could be used to get access to sensitive data, to inject malicious UPDATE statements that could have also impact on the operating system, to disrupt the functionality of the SAP system which can thereby lead to a Denial of Service.

Affected

22 ranges

Vendor	Product	Version range	Fixed in
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap	bw_4hana	—	—
sap	bw_4hana	—	—
sap_se	sap_business_warehouse	< 700	700
sap_se	sap_business_warehouse	< 701	701
sap_se	sap_business_warehouse	< 702	702
sap_se	sap_business_warehouse	< 711	711
sap_se	sap_business_warehouse	< 730	730
sap_se	sap_business_warehouse	< 731	731
sap_se	sap_business_warehouse	< 740	740
sap_se	sap_business_warehouse	< 750	750
sap_se	sap_business_warehouse	< 782	782
sap_se	sap_bw_4hana	< 100	100
sap_se	sap_bw_4hana	< 200	200

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v3.0 9.9 CRITICAL CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94