CVE-2021-21465

 

Published at: - 12-01-2021 04:15

Last modified: - 03-06-2022 03:18

Total changes: - 6

Description

The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the database will execute without properly sanitizing the untrusted data leading to SQL injection vulnerability which can fully compromise the affected SAP system.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476
• https://launchpad.support.sap.com/#/notes/2986980
• 20220518 SEC Consult SA-20220518-0 :: Multiple Critical Vulnerabilities in SAP Application Server, ABAP and ABAP Platform (Different Software Components)-Exploit, Mailing List, Third Party Advisory
• http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html

 

Keywords

NVD

 

CVE-2021-21465

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures