CVE-2021-21468

published 2021-01-12

CVE-2021-21468: The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges that allows the user…

Priority P3 38 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C H I N A N

The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges that allows the user to practically read out any database table.

Affected

24 ranges

Vendor	Product	Version range	Fixed in
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap	business_warehouse	—	—
sap_se	sap_business_warehouse	< 710	710
sap_se	sap_business_warehouse	< 711	711
sap_se	sap_business_warehouse	< 730	730
sap_se	sap_business_warehouse	< 731	731
sap_se	sap_business_warehouse	< 740	740
sap_se	sap_business_warehouse	< 750	750
sap_se	sap_business_warehouse	< 751	751
sap_se	sap_business_warehouse	< 752	752
sap_se	sap_business_warehouse	< 753	753
sap_se	sap_business_warehouse	< 754	754
sap_se	sap_business_warehouse	< 755	755
sap_se	sap_business_warehouse	< 782	782

CVSS provenance

nvd v3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

nvd v3.0 6.5 MEDIUM CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 4.0 MEDIUM AV:N/AC:L/Au:S/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-862