CVE-2021-21468

 

Published at: - 12-01-2021 04:15

Last modified: - 19-05-2022 08:15

Total changes: - 5

Description

The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges that allows the user to practically read out any database table.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

 

Verification logic

 

Reference

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476
• https://launchpad.support.sap.com/#/notes/2986980
• 20220518 SEC Consult SA-20220518-0 :: Multiple Critical Vulnerabilities in SAP Application Server, ABAP and ABAP Platform (Different Software Components)-
• http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html

 

Keywords

NVD

 

CVE-2021-21468

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures