CVE-2021-21465 | BDVDB-2026-147397 Detail
SAP SESAP Business Warehouse
Description#
The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the database will execute without properly sanitizing the untrusted data leading to SQL injection vulnerability which can fully compromise the affected SAP system.
Impact#
Per CVSS v3.0: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
No weakness recorded in the source data.
References#
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476
- https://launchpad.support.sap.com/#/notes/2986980
- http://seclists.org/fulldisclosure/2022/May/42
- http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.