CVE-2021-21465 (GCVE-0-2021-21465)

Vulnerability from cvelistv5 – Published: 2021-01-12 14:40 – Updated: 2024-08-03 18:16
VLAI?
Summary
The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the database will execute without properly sanitizing the untrusted data leading to SQL injection vulnerability which can fully compromise the affected SAP system.
Severity ?
9.9 (Critical)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE
  • SQL Injection
Assigner
sap
References
Impacted products
Vendor Product Version
SAP SE SAP Business Warehouse Affected: < 710
Affected: < 711
Affected: < 730
Affected: < 731
Affected: < 740
Affected: < 750
Affected: < 751
Affected: < 752
Affected: < 753
Affected: < 754
Affected: < 755
Affected: < 782
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:16:22.474Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://launchpad.support.sap.com/#/notes/2986980"
          },
          {
            "name": "20220518 SEC Consult SA-20220518-0 :: Multiple Critical Vulnerabilities in SAP Application Server, ABAP and ABAP Platform (Different Software Components)",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2022/May/42"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SAP Business Warehouse",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 710"
            },
            {
              "status": "affected",
              "version": "\u003c 711"
            },
            {
              "status": "affected",
              "version": "\u003c 730"
            },
            {
              "status": "affected",
              "version": "\u003c 731"
            },
            {
              "status": "affected",
              "version": "\u003c 740"
            },
            {
              "status": "affected",
              "version": "\u003c 750"
            },
            {
              "status": "affected",
              "version": "\u003c 751"
            },
            {
              "status": "affected",
              "version": "\u003c 752"
            },
            {
              "status": "affected",
              "version": "\u003c 753"
            },
            {
              "status": "affected",
              "version": "\u003c 754"
            },
            {
              "status": "affected",
              "version": "\u003c 755"
            },
            {
              "status": "affected",
              "version": "\u003c 782"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the database will execute without properly sanitizing the untrusted data leading to SQL injection vulnerability which can fully compromise the affected SAP system."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "SQL Injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-05-19T17:06:15",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://launchpad.support.sap.com/#/notes/2986980"
        },
        {
          "name": "20220518 SEC Consult SA-20220518-0 :: Multiple Critical Vulnerabilities in SAP Application Server, ABAP and ABAP Platform (Different Software Components)",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2022/May/42"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@sap.com",
          "ID": "CVE-2021-21465",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SAP Business Warehouse",
                      "version": {
                        "version_data": [
                          {
                            "version_name": "\u003c",
                            "version_value": "710"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "711"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "730"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "731"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "740"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "750"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "751"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "752"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "753"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "754"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "755"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "782"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SAP SE"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the database will execute without properly sanitizing the untrusted data leading to SQL injection vulnerability which can fully compromise the affected SAP system."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "9.9",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "SQL Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476",
              "refsource": "MISC",
              "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476"
            },
            {
              "name": "https://launchpad.support.sap.com/#/notes/2986980",
              "refsource": "MISC",
              "url": "https://launchpad.support.sap.com/#/notes/2986980"
            },
            {
              "name": "20220518 SEC Consult SA-20220518-0 :: Multiple Critical Vulnerabilities in SAP Application Server, ABAP and ABAP Platform (Different Software Components)",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2022/May/42"
            },
            {
              "name": "http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2021-21465",
    "datePublished": "2021-01-12T14:40:57",
    "dateReserved": "2020-12-30T00:00:00",
    "dateUpdated": "2024-08-03T18:16:22.474Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:business_warehouse:710:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C7FAC6A3-1ADF-48F2-971B-5ADF9F101583\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:business_warehouse:711:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"11DE777B-AA53-4A6B-AD6E-5DCEEAC217AA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:business_warehouse:730:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EF8F2CE3-BA4B-4A9C-A284-87F0AB797B92\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:business_warehouse:731:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"00732AD2-BEED-4C1F-AC39-46E6F33CBB5E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:business_warehouse:740:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EC7DABAD-36FA-49D7-8C3C-3AA49604BE37\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:business_warehouse:750:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"526C11C6-B67D-49F1-94E6-A324AA581EDD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:business_warehouse:751:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4A4E38AC-5888-4ABD-AAB1-BC5312701195\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:business_warehouse:752:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8D7A93A1-3D65-4C79-92B1-E433EE443478\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:business_warehouse:753:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"80E03381-893C-4646-9150-303AB4F6144B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:business_warehouse:754:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1400B8E5-8400-420A-8581-9F3B07EF6BF4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:business_warehouse:755:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2ABE173B-C66E-4A69-9735-E325C0DAC062\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:business_warehouse:782:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"929A4FB3-BEEF-4A69-B77C-FD1A0B3C7DFF\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the database will execute without properly sanitizing the untrusted data leading to SQL injection vulnerability which can fully compromise the affected SAP system.\"}, {\"lang\": \"es\", \"value\": \"La Interfaz de Base de Datos de BW permite a un atacante con pocos privilegios ejecutar cualquier consulta de la base de datos dise\\u00f1ada, exponiendo la base de datos del backend.\u0026#xa0;Un atacante puede incluir sus propios comandos SQL que la base de datos ejecutar\\u00e1 sin sanear apropiadamente los datos no confiables, conllevando a una vulnerabilidad de inyecci\\u00f3n SQL que puede comprometer por completo el sistema SAP afectado\"}]",
      "id": "CVE-2021-21465",
      "lastModified": "2024-11-21T05:48:25.633",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\", \"baseScore\": 9.9, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.1, \"impactScore\": 6.0}], \"cvssMetricV30\": [{\"source\": \"cna@sap.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\", \"baseScore\": 9.9, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.1, \"impactScore\": 6.0}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:S/C:P/I:P/A:P\", \"baseScore\": 6.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.0, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2021-01-12T15:15:15.860",
      "references": "[{\"url\": \"http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html\", \"source\": \"cna@sap.com\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://seclists.org/fulldisclosure/2022/May/42\", \"source\": \"cna@sap.com\", \"tags\": [\"Exploit\", \"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://launchpad.support.sap.com/#/notes/2986980\", \"source\": \"cna@sap.com\", \"tags\": [\"Permissions Required\"]}, {\"url\": \"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476\", \"source\": \"cna@sap.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://seclists.org/fulldisclosure/2022/May/42\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://launchpad.support.sap.com/#/notes/2986980\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Permissions Required\"]}, {\"url\": \"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "cna@sap.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-89\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-21465\",\"sourceIdentifier\":\"cna@sap.com\",\"published\":\"2021-01-12T15:15:15.860\",\"lastModified\":\"2024-11-21T05:48:25.633\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the database will execute without properly sanitizing the untrusted data leading to SQL injection vulnerability which can fully compromise the affected SAP system.\"},{\"lang\":\"es\",\"value\":\"La Interfaz de Base de Datos de BW permite a un atacante con pocos privilegios ejecutar cualquier consulta de la base de datos dise\u00f1ada, exponiendo la base de datos del backend.\u0026#xa0;Un atacante puede incluir sus propios comandos SQL que la base de datos ejecutar\u00e1 sin sanear apropiadamente los datos no confiables, conllevando a una vulnerabilidad de inyecci\u00f3n SQL que puede comprometer por completo el sistema SAP afectado\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.9,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.1,\"impactScore\":6.0}],\"cvssMetricV30\":[{\"source\":\"cna@sap.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.9,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.1,\"impactScore\":6.0}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:P/A:P\",\"baseScore\":6.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-89\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:business_warehouse:710:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C7FAC6A3-1ADF-48F2-971B-5ADF9F101583\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:business_warehouse:711:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"11DE777B-AA53-4A6B-AD6E-5DCEEAC217AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:business_warehouse:730:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EF8F2CE3-BA4B-4A9C-A284-87F0AB797B92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:business_warehouse:731:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"00732AD2-BEED-4C1F-AC39-46E6F33CBB5E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:business_warehouse:740:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EC7DABAD-36FA-49D7-8C3C-3AA49604BE37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:business_warehouse:750:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"526C11C6-B67D-49F1-94E6-A324AA581EDD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:business_warehouse:751:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4A4E38AC-5888-4ABD-AAB1-BC5312701195\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:business_warehouse:752:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D7A93A1-3D65-4C79-92B1-E433EE443478\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:business_warehouse:753:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"80E03381-893C-4646-9150-303AB4F6144B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:business_warehouse:754:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1400B8E5-8400-420A-8581-9F3B07EF6BF4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:business_warehouse:755:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2ABE173B-C66E-4A69-9735-E325C0DAC062\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:business_warehouse:782:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"929A4FB3-BEEF-4A69-B77C-FD1A0B3C7DFF\"}]}]}],\"references\":[{\"url\":\"http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html\",\"source\":\"cna@sap.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://seclists.org/fulldisclosure/2022/May/42\",\"source\":\"cna@sap.com\",\"tags\":[\"Exploit\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://launchpad.support.sap.com/#/notes/2986980\",\"source\":\"cna@sap.com\",\"tags\":[\"Permissions Required\"]},{\"url\":\"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476\",\"source\":\"cna@sap.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://seclists.org/fulldisclosure/2022/May/42\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://launchpad.support.sap.com/#/notes/2986980\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Permissions Required\"]},{\"url\":\"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.