Vulnerability CVE-2021-21468
Published: 2021-01-12

Description:
The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges that allows the user to practically read out any database table.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
SAP Application Server ABAP / ABAP Platform Code Injection / SQL Injection / Missing Authorization
Fabian Hagg
22.05.2022

Type:

CWE-862

 (Missing Authorization)

CVSS2 => (AV:N/AC:L/Au:S/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4/10
2.9/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
SAP -> Business warehouse 

 References:
https://i7p.wdf.sap.corp/sap/support/notes/2986980
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476
Copyright 2024, cxsecurity.com

 

Back to Top