CVE-2021-21468

The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges that allows the user to practically read out any database table.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sap:business_warehouse:710:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_warehouse:711:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_warehouse:730:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_warehouse:731:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_warehouse:740:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_warehouse:750:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_warehouse:751:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_warehouse:752:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_warehouse:753:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_warehouse:754:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_warehouse:755:*:*:*:*:*:*:*
cpe:2.3:a:sap:business_warehouse:782:*:*:*:*:*:*:*

History

21 Nov 2024, 05:48

Type Values Removed Values Added
References () http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html - Exploit, Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html - Exploit, Third Party Advisory, VDB Entry
References () http://seclists.org/fulldisclosure/2022/May/42 - Exploit, Mailing List, Third Party Advisory () http://seclists.org/fulldisclosure/2022/May/42 - Exploit, Mailing List, Third Party Advisory
References () https://launchpad.support.sap.com/#/notes/2986980 - Permissions Required, Vendor Advisory () https://launchpad.support.sap.com/#/notes/2986980 - Permissions Required, Vendor Advisory
References () https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476 - Vendor Advisory () https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476 - Vendor Advisory

19 May 2022, 18:15

Type Values Removed Values Added
References
  • (MISC) http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html -

19 May 2022, 00:15

Type Values Removed Values Added
References
  • (FULLDISC) http://seclists.org/fulldisclosure/2022/May/42 -

Information

Published : 2021-01-12 15:15

Updated : 2024-11-21 05:48


NVD link : CVE-2021-21468

Mitre link : CVE-2021-21468

CVE.ORG link : CVE-2021-21468


JSON object : View

Products Affected

sap

  • business_warehouse
CWE
CWE-862

Missing Authorization