Lucene search

[email protected]CVE-2021-21468

HistoryJan 12, 2021 - 3:15 p.m.

CVE-2021-21468

2021-01-1215:15:00

CWE-862

[email protected]

web.nvd.nist.gov

cve-2021-21468

bw database interface

authorization checks

privilege escalation

nvd

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

7.2 High

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.007 Low

EPSS

Percentile

80.2%

JSON

The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges that allows the user to practically read out any database table.

CPENameOperatorVersion
sap:business_warehousesap business warehouseeq731
sap:business_warehousesap business warehouseeq740
sap:business_warehousesap business warehouseeq750
sap:business_warehousesap business warehouseeq751
sap:business_warehousesap business warehouseeq752
sap:business_warehousesap business warehouseeq753
sap:business_warehousesap business warehouseeq754
sap:business_warehousesap business warehouseeq755
sap:business_warehousesap business warehouseeq782
sap:business_warehousesap business warehouseeq730

CPE	Name	Operator	Version
sap:business_warehouse	sap business warehouse	eq	731
sap:business_warehouse	sap business warehouse	eq	740
sap:business_warehouse	sap business warehouse	eq	750
sap:business_warehouse	sap business warehouse	eq	751
sap:business_warehouse	sap business warehouse	eq	752
sap:business_warehouse	sap business warehouse	eq	753
sap:business_warehouse	sap business warehouse	eq	754
sap:business_warehouse	sap business warehouse	eq	755
sap:business_warehouse	sap business warehouse	eq	782
sap:business_warehouse	sap business warehouse	eq	730

Rows per page:

1-10 of 121

References

packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html

seclists.org/fulldisclosure/2022/May/42

launchpad.support.sap.com/#/notes/2986980

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476

Social References

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

7.2 High

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.007 Low

EPSS

Percentile

80.2%

JSON

Related for CVE-2021-21468

prion1 cvelist1 packetstorm1