PT-2021-14534 · Sap · Sap Business Warehouse+1

Alexander Meier + 1 · Published 2021-01-12 · Updated 2022-10-01 · CVE-2021-21466

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Business Warehouse versions 700 through 750, 782 SAP BW/4HANA versions 100 through 200

Description The issue allows a low-privileged attacker to inject code using a remote-enabled function module over the network. This can lead to the creation of a malicious ABAP report, which can be used to access sensitive data, inject malicious UPDATE statements that could impact the operating system, or disrupt the functionality of the SAP system, potentially leading to a Denial of Service.

Recommendations For SAP Business Warehouse versions 700 through 750, 782, update to a version that includes the fix for this issue. For SAP BW/4HANA versions 100 through 200, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2021-21466

Affected Products

Sap Bw/4Hana

Sap Business Warehouse

References · 6

• 🔥 http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2022/May/42 · Exploit
• https://launchpad.support.sap.com/#/notes/2999854 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21466 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21466 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476 · Vendor Advisory