CVE-2021-21468

The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges that allows the user to practically read out any database table.

Link	Resource
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476	Vendor Advisory
https://launchpad.support.sap.com/#/notes/2986980	Permissions Required Vendor Advisory
http://seclists.org/fulldisclosure/2022/May/42	Exploit Mailing List
http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html	Exploit Third Party Advisory

Configuration 1

cpe:2.3:a:sap:business_warehouse:731:*:*:*:*:*:*:* cpe:2.3:a:sap:business_warehouse:740:*:*:*:*:*:*:* cpe:2.3:a:sap:business_warehouse:750:*:*:*:*:*:*:* cpe:2.3:a:sap:business_warehouse:751:*:*:*:*:*:*:* cpe:2.3:a:sap:business_warehouse:752:*:*:*:*:*:*:* cpe:2.3:a:sap:business_warehouse:753:*:*:*:*:*:*:* cpe:2.3:a:sap:business_warehouse:754:*:*:*:*:*:*:* cpe:2.3:a:sap:business_warehouse:755:*:*:*:*:*:*:* cpe:2.3:a:sap:business_warehouse:782:*:*:*:*:*:*:* cpe:2.3:a:sap:business_warehouse:730:*:*:*:*:*:*:* cpe:2.3:a:sap:business_warehouse:711:*:*:*:*:*:*:* cpe:2.3:a:sap:business_warehouse:710:*:*:*:*:*:*:*

---

Published : 2021-01-12 03:15

Updated : 2022-10-01 02:03

---

NVD link : CVE-2021-21468

Mitre link : CVE-2021-21468

No products.

CWE-862