CVE-2021-21465
CRITICALSAP Business Warehouse - Authenticated SQL Injection via BW Database Interface
Title source: llmDescription
The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the database will execute without properly sanitizing the untrusted data leading to SQL injection vulnerability which can fully compromise the affected SAP system.
References (4)
Core 4
Core References
Vendor Advisory x_refsource_misc
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476
Permissions Required x_refsource_misc
https://launchpad.support.sap.com/#/notes/2986980
Exploit, Mailing List, Third Party Advisory mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2022/May/42
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html
Scores
CVSS v3
9.9
EPSS
0.0143
EPSS Percentile
80.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Details
CWE
CWE-89
Status
published
Products (12)
sap/business_warehouse
710
sap/business_warehouse
711
sap/business_warehouse
730
sap/business_warehouse
731
sap/business_warehouse
740
sap/business_warehouse
750
sap/business_warehouse
751
sap/business_warehouse
752
sap/business_warehouse
753
sap/business_warehouse
754
... and 2 more
Published
Jan 12, 2021
Tracked Since
Feb 18, 2026