CVE-2021-21468
Estado: ModificadaMedia (6.5)—
The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges that allows the user to practically read out any database table.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Puntuación base: 6.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.90%
- Percentil entre todas las CVEs puntuadas: 79
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-862
Referencias
- http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html
- http://seclists.org/fulldisclosure/2022/May/42
- https://launchpad.support.sap.com/#/notes/2986980
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476
- http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html
- http://seclists.org/fulldisclosure/2022/May/42
- https://launchpad.support.sap.com/#/notes/2986980
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476
JSON original (NVD)
Mostrar
{
"id": "CVE-2021-21468",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"authentication": "SINGLE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Secondary",
"source": "cna@sap.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 3.6,
"exploitabilityScore": 2.8
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 3.6,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "cna@sap.com",
"affectedData": [
{
"vendor": "SAP SE",
"product": "SAP Business Warehouse",
"versions": [
{
"status": "affected",
"version": "< 710"
},
{
"status": "affected",
"version": "< 711"
},
{
"status": "affected",
"version": "< 730"
},
{
"status": "affected",
"version": "< 731"
},
{
"status": "affected",
"version": "< 740"
},
{
"status": "affected",
"version": "< 750"
},
{
"status": "affected",
"version": "< 751"
},
{
"status": "affected",
"version": "< 752"
},
{
"status": "affected",
"version": "< 753"
},
{
"status": "affected",
"version": "< 754"
},
{
"status": "affected",
"version": "< 755"
},
{
"status": "affected",
"version": "< 782"
}
]
}
]
}
],
"published": "2021-01-12T15:15:16.093",
"references": [
{
"url": "http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"source": "cna@sap.com"
},
{
"url": "http://seclists.org/fulldisclosure/2022/May/42",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"source": "cna@sap.com"
},
{
"url": "https://launchpad.support.sap.com/#/notes/2986980",
"tags": [
"Permissions Required",
"Vendor Advisory"
],
"source": "cna@sap.com"
},
{
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476",
"tags": [
"Vendor Advisory"
],
"source": "cna@sap.com"
},
{
"url": "http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://seclists.org/fulldisclosure/2022/May/42",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://launchpad.support.sap.com/#/notes/2986980",
"tags": [
"Permissions Required",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-862"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges that allows the user to practically read out any database table."
},
{
"lang": "es",
"value": "La interfaz de Base de Datos de BW no lleva a cabo las comprobaciones de autorización necesarias para un usuario autenticado, resultando en una escalada de privilegios que permite al usuario leer prácticamente cualquier tabla de la base de datos"
}
],
"lastModified": "2026-06-17T03:35:37.933",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sap:business_warehouse:710:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C7FAC6A3-1ADF-48F2-971B-5ADF9F101583"
},
{
"criteria": "cpe:2.3:a:sap:business_warehouse:711:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "11DE777B-AA53-4A6B-AD6E-5DCEEAC217AA"
},
{
"criteria": "cpe:2.3:a:sap:business_warehouse:730:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EF8F2CE3-BA4B-4A9C-A284-87F0AB797B92"
},
{
"criteria": "cpe:2.3:a:sap:business_warehouse:731:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "00732AD2-BEED-4C1F-AC39-46E6F33CBB5E"
},
{
"criteria": "cpe:2.3:a:sap:business_warehouse:740:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EC7DABAD-36FA-49D7-8C3C-3AA49604BE37"
},
{
"criteria": "cpe:2.3:a:sap:business_warehouse:750:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "526C11C6-B67D-49F1-94E6-A324AA581EDD"
},
{
"criteria": "cpe:2.3:a:sap:business_warehouse:751:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4A4E38AC-5888-4ABD-AAB1-BC5312701195"
},
{
"criteria": "cpe:2.3:a:sap:business_warehouse:752:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8D7A93A1-3D65-4C79-92B1-E433EE443478"
},
{
"criteria": "cpe:2.3:a:sap:business_warehouse:753:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "80E03381-893C-4646-9150-303AB4F6144B"
},
{
"criteria": "cpe:2.3:a:sap:business_warehouse:754:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1400B8E5-8400-420A-8581-9F3B07EF6BF4"
},
{
"criteria": "cpe:2.3:a:sap:business_warehouse:755:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2ABE173B-C66E-4A69-9735-E325C0DAC062"
},
{
"criteria": "cpe:2.3:a:sap:business_warehouse:782:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "929A4FB3-BEEF-4A69-B77C-FD1A0B3C7DFF"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cna@sap.com"
}