CVE-2021-21465

Description

The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the database will execute without properly sanitizing the untrusted data leading to SQL injection vulnerability which can fully compromise the affected SAP system.

Weakness classification

• nvd@nist.gov: CWE-89

Primary references

• cna@sap.com — Exploit, Third Party Advisory, VDB Entry
• cna@sap.com — Exploit, Mailing List, Third Party Advisory
• cna@sap.com — Permissions Required
• cna@sap.com — Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Mailing List, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Permissions Required
• af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory