CVE-2021-21466

SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow a low privileged attacker to inject code using a remote enabled function module over the network. Via the function module an attacker can create a malicious ABAP report which could be used to get access to sensitive data, to inject malicious UPDATE statements that could have also impact on the operating system, to disrupt the functionality of the SAP system which can thereby lead to a Denial of Service.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sap:business_warehouse:700:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_warehouse:701:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_warehouse:702:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_warehouse:711:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_warehouse:730:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_warehouse:731:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_warehouse:740:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_warehouse:750:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_warehouse:782:*:*:*:*:*:*:*
cpe:2.3:a:sap:bw\/4hana:100:*:*:*:*:*:*:*
cpe:2.3:a:sap:bw\/4hana:200:*:*:*:*:*:*:*

History

21 Nov 2024, 05:48

Type Values Removed Values Added
References () http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html - Exploit, Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html - Exploit, Third Party Advisory, VDB Entry
References () http://seclists.org/fulldisclosure/2022/May/42 - Exploit, Mailing List, Third Party Advisory () http://seclists.org/fulldisclosure/2022/May/42 - Exploit, Mailing List, Third Party Advisory
References () https://launchpad.support.sap.com/#/notes/2999854 - Permissions Required, Vendor Advisory () https://launchpad.support.sap.com/#/notes/2999854 - Permissions Required, Vendor Advisory
References () https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476 - Vendor Advisory () https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476 - Vendor Advisory

19 May 2022, 18:15

Type Values Removed Values Added
References
  • (MISC) http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html -

19 May 2022, 00:15

Type Values Removed Values Added
References
  • (FULLDISC) http://seclists.org/fulldisclosure/2022/May/42 -

23 Jun 2021, 12:15

Type Values Removed Values Added
References
  • {'url': 'https://i7p.wdf.sap.corp/sap/support/notes/2999854', 'name': 'https://i7p.wdf.sap.corp/sap/support/notes/2999854', 'tags': ['Broken Link'], 'refsource': 'MISC'}

Information

Published : 2021-01-12 15:15

Updated : 2024-11-21 05:48


NVD link : CVE-2021-21466

Mitre link : CVE-2021-21466

CVE.ORG link : CVE-2021-21466


JSON object : View

Products Affected

sap

  • bw\/4hana
  • business_warehouse
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')