Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-21465

The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the database will execute without properly sanitizing the untrusted data leading to SQL injection vulnerability which can fully compromise the affected SAP system.

Published

2021-01-12T15:15:15.860

Last Modified

2024-11-21T05:48:25.633

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.9 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

8.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-89
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application sap business_warehouse 710 Yes
Application sap business_warehouse 711 Yes
Application sap business_warehouse 730 Yes
Application sap business_warehouse 731 Yes
Application sap business_warehouse 740 Yes
Application sap business_warehouse 750 Yes
Application sap business_warehouse 751 Yes
Application sap business_warehouse 752 Yes
Application sap business_warehouse 753 Yes
Application sap business_warehouse 754 Yes
Application sap business_warehouse 755 Yes
Application sap business_warehouse 782 Yes
References