CVE-2021-21466

HIGH

SAP Business Warehouse and BW/4HANA - Code Injection via Remote Function Module

Title source: llm
STIX 2.1

Description

SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow a low privileged attacker to inject code using a remote enabled function module over the network. Via the function module an attacker can create a malicious ABAP report which could be used to get access to sensitive data, to inject malicious UPDATE statements that could have also impact on the operating system, to disrupt the functionality of the SAP system which can thereby lead to a Denial of Service.

References (4)

Core 4
Core References
Permissions Required, Vendor Advisory x_refsource_misc
https://launchpad.support.sap.com/#/notes/2999854
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2022/May/42

Scores

CVSS v3 8.8
EPSS 0.0070
EPSS Percentile 72.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-94
Status published
Products (11)
sap/business_warehouse 700
sap/business_warehouse 701
sap/business_warehouse 702
sap/business_warehouse 711
sap/business_warehouse 730
sap/business_warehouse 731
sap/business_warehouse 740
sap/business_warehouse 750
sap/business_warehouse 782
sap/bw\/4hana 100
... and 1 more
Published Jan 12, 2021
Tracked Since Feb 18, 2026