CVE-2021-21468

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges that allows the user to practically read out any database table.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
SAP SE	SAP Business Warehouse	< 710; < 711; < 730; < 731; < 740; < 750; < 751; < 752; < 753; < 754; < 755; < 782

References

http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2022/May/42Exploit, Mailing List, Third Party Advisory
https://launchpad.support.sap.com/#/notes/2986980Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476Vendor Advisory
http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2022/May/42Exploit, Mailing List, Third Party Advisory
https://launchpad.support.sap.com/#/notes/2986980Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476Vendor Advisory

Timeline

Published: Jan 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-214697.5When security guidelines for SAP NetWeaver Master Data Management running on windows have not been thoroughly reviewed, it might be possible CVE-2021-21471.8Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Installation). The supported version that is aff CVE-2021-214704.4SAP EPM Add-in for Microsoft Office, version - 1010 and SAP EPM Add-in for SAP Analysis Office, version - 2.8, allows an authenticated attac CVE-2021-214716.5In CLA-Assistant, versions before 2.8.5, due to improper access control an authenticated user could access API endpoints which are not inten CVE-2021-214728.8SAP Software Provisioning Manager 1.0 (SAP NetWeaver Master Data Management Server 7.1) does not have an option to set password during its i CVE-2021-214736.3SAP NetWeaver AS ABAP and ABAP Platform, versions - 700, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, contains function modul CVE-2021-214746.5SAP HANA Database, versions - 1.0, 2.0, accepts SAML tokens with MD5 digest, an attacker who manages to obtain an MD5-digest signed SAML Ass CVE-2021-214757.5Under specific circumstances SAP Master Data Management, versions - 710, 710.750, allows an unauthorized attacker to exploit insufficient va CVE-2021-214766.1SAP UI5 versions before 1.38.49, 1.52.49, 1.60.34, 1.71.31, 1.78.18, 1.84.5, 1.85.4, 1.86.1 allows an unauthenticated attacker to redirect u CVE-2021-214779.9SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticat CVE-2021-214786.1SAP Web Dynpro ABAP allow an attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities.CVE-2021-214799.1In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availability and integrity o