CVE-2021-21466: Code Injection
First published: Tue Jan 12 2021(Updated: )
SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow a low privileged attacker to inject code using a remote enabled function module over the network. Via the function module an attacker can create a malicious ABAP report which could be used to get access to sensitive data, to inject malicious UPDATE statements that could have also impact on the operating system, to disrupt the functionality of the SAP system which can thereby lead to a Denial of Service.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP Business Warehouse | =700 | |
| SAP Business Warehouse | =701 | |
| SAP Business Warehouse | =702 | |
| SAP Business Warehouse | =711 | |
| SAP Business Warehouse | =730 | |
| SAP Business Warehouse | =731 | |
| SAP Business Warehouse | =740 | |
| SAP Business Warehouse | =750 | |
| SAP Business Warehouse | =782 | |
| Sap Bw\/4hana | =100 | |
| Sap Bw\/4hana | =200 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html
- http://seclists.org/fulldisclosure/2022/May/42
- https://launchpad.support.sap.com/#/notes/2999854
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476
Frequently Asked Questions
What is CVE-2021-21466?
CVE-2021-21466 is a vulnerability in SAP Business Warehouse and SAP BW/4HANA that allows a low privileged attacker to inject code using a remote enabled function module over the network.
Which versions of SAP Business Warehouse are affected by CVE-2021-21466?
The following versions of SAP Business Warehouse are affected: 700, 701, 702, 711, 730, 731, 740, 750, and 782.
Which versions of SAP BW/4HANA are affected by CVE-2021-21466?
The following versions of SAP BW/4HANA are affected: 100 and 200.
What is the severity of CVE-2021-21466?
CVE-2021-21466 has a severity rating of 8.8, which is classified as critical.
How can I mitigate the vulnerability (CVE-2021-21466)?
To mitigate CVE-2021-21466, it is recommended to apply the necessary security patches provided by SAP and follow their security guidelines.
- collector/nvd-index
- agent/weakness
- agent/severity
- agent/author
- agent/tags
- agent/event
- agent/type
- agent/references
- agent/description
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- vendor/sap
- canonical/sap business warehouse
- version/sap business warehouse/700
- version/sap business warehouse/701
- version/sap business warehouse/702
- version/sap business warehouse/711
- version/sap business warehouse/730
- version/sap business warehouse/731
- version/sap business warehouse/740
- version/sap business warehouse/750
- version/sap business warehouse/782
- canonical/sap bw\/4hana
- version/sap bw\/4hana/100
- version/sap bw\/4hana/200