// For flags

CVE-2021-21466

SAP Application Server ABAP / ABAP Platform Code Injection / SQL Injection / Missing Authorization

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow a low privileged attacker to inject code using a remote enabled function module over the network. Via the function module an attacker can create a malicious ABAP report which could be used to get access to sensitive data, to inject malicious UPDATE statements that could have also impact on the operating system, to disrupt the functionality of the SAP system which can thereby lead to a Denial of Service.

SAP Business Warehouse, versiones 700, 701, 702, 711, 730, 731, 740, 750, 782 y SAP BW/4HANA, versiones 100, 200, permiten a un atacante poco privilegiado inyectar código usando un módulo de función habilitado de forma remota a través de la red. Por medio del módulo de función, un atacante puede crear un reporte ABAP malicioso que podría ser usado para obtener acceso a datos confidenciales, para inyectar sentencias UPDATE maliciosas que también podrían tener un impacto en el sistema operativo, para interrumpir la funcionalidad del sistema SAP que, por lo tanto, puede conducir a una denegación de servicio

The SAP application server ABAP and ABAP Platform are susceptible to code injection, SQL injection, and missing authorization vulnerabilities. Multiple SAP products are affected.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-12-30 CVE Reserved
  • 2021-01-12 CVE Published
  • 2024-05-17 EPSS Updated
  • 2024-08-03 CVE Updated
  • 2024-08-03 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Sap
Search vendor "Sap"
 Business Warehouse
Search vendor "Sap" for product "Business Warehouse"
 700
Search vendor "Sap" for product "Business Warehouse" and version "700"
-
Affected
Sap
Search vendor "Sap"
 Business Warehouse
Search vendor "Sap" for product "Business Warehouse"
 701
Search vendor "Sap" for product "Business Warehouse" and version "701"
-
Affected
Sap
Search vendor "Sap"
 Business Warehouse
Search vendor "Sap" for product "Business Warehouse"
 702
Search vendor "Sap" for product "Business Warehouse" and version "702"
-
Affected
Sap
Search vendor "Sap"
 Business Warehouse
Search vendor "Sap" for product "Business Warehouse"
 711
Search vendor "Sap" for product "Business Warehouse" and version "711"
-
Affected
Sap
Search vendor "Sap"
 Business Warehouse
Search vendor "Sap" for product "Business Warehouse"
 730
Search vendor "Sap" for product "Business Warehouse" and version "730"
-
Affected
Sap
Search vendor "Sap"
 Business Warehouse
Search vendor "Sap" for product "Business Warehouse"
 731
Search vendor "Sap" for product "Business Warehouse" and version "731"
-
Affected
Sap
Search vendor "Sap"
 Business Warehouse
Search vendor "Sap" for product "Business Warehouse"
 740
Search vendor "Sap" for product "Business Warehouse" and version "740"
-
Affected
Sap
Search vendor "Sap"
 Business Warehouse
Search vendor "Sap" for product "Business Warehouse"
 750
Search vendor "Sap" for product "Business Warehouse" and version "750"
-
Affected
Sap
Search vendor "Sap"
 Business Warehouse
Search vendor "Sap" for product "Business Warehouse"
 782
Search vendor "Sap" for product "Business Warehouse" and version "782"
-
Affected
Sap
Search vendor "Sap"
 Bw\/4hana
Search vendor "Sap" for product "Bw\/4hana"
 100
Search vendor "Sap" for product "Bw\/4hana" and version "100"
-
Affected
Sap
Search vendor "Sap"
 Bw\/4hana
Search vendor "Sap" for product "Bw\/4hana"
 200
Search vendor "Sap" for product "Bw\/4hana" and version "200"
-
Affected