{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-30T03:16:44.423","vulnerabilities":[{"cve":{"id":"CVE-2021-21466","sourceIdentifier":"cna@sap.com","published":"2021-01-12T15:15:15.953","lastModified":"2024-11-21T05:48:25.767","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow a low privileged attacker to inject code using a remote enabled function module over the network. Via the function module an attacker can create a malicious ABAP report which could be used to get access to sensitive data, to inject malicious UPDATE statements that could have also impact on the operating system, to disrupt the functionality of the SAP system which can thereby lead to a Denial of Service."},{"lang":"es","value":"SAP Business Warehouse, versiones 700, 701, 702, 711, 730, 731, 740, 750, 782 y SAP BW/4HANA, versiones 100, 200, permiten a un atacante poco privilegiado inyectar código usando un módulo de función habilitado de forma remota a través de la red. Por medio del módulo de función, un atacante puede crear un reporte ABAP malicioso que podría ser usado para obtener acceso a datos confidenciales, para inyectar sentencias UPDATE maliciosas que también podrían tener un impacto en el sistema operativo, para interrumpir la funcionalidad del sistema SAP que, por lo tanto, puede conducir a una denegación de servicio"}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV30":[{"source":"cna@sap.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sap:business_warehouse:700:*:*:*:*:*:*:*","matchCriteriaId":"D495F997-45A9-4C80-841E-781E1EAC3074"},{"vulnerable":true,"criteria":"cpe:2.3:a:sap:business_warehouse:701:*:*:*:*:*:*:*","matchCriteriaId":"2FCA6F5A-25B8-46E1-B407-38F61222C057"},{"vulnerable":true,"criteria":"cpe:2.3:a:sap:business_warehouse:702:*:*:*:*:*:*:*","matchCriteriaId":"3FE999EE-9B6B-4D2C-9347-5558B878AE7B"},{"vulnerable":true,"criteria":"cpe:2.3:a:sap:business_warehouse:711:*:*:*:*:*:*:*","matchCriteriaId":"11DE777B-AA53-4A6B-AD6E-5DCEEAC217AA"},{"vulnerable":true,"criteria":"cpe:2.3:a:sap:business_warehouse:730:*:*:*:*:*:*:*","matchCriteriaId":"EF8F2CE3-BA4B-4A9C-A284-87F0AB797B92"},{"vulnerable":true,"criteria":"cpe:2.3:a:sap:business_warehouse:731:*:*:*:*:*:*:*","matchCriteriaId":"00732AD2-BEED-4C1F-AC39-46E6F33CBB5E"},{"vulnerable":true,"criteria":"cpe:2.3:a:sap:business_warehouse:740:*:*:*:*:*:*:*","matchCriteriaId":"EC7DABAD-36FA-49D7-8C3C-3AA49604BE37"},{"vulnerable":true,"criteria":"cpe:2.3:a:sap:business_warehouse:750:*:*:*:*:*:*:*","matchCriteriaId":"526C11C6-B67D-49F1-94E6-A324AA581EDD"},{"vulnerable":true,"criteria":"cpe:2.3:a:sap:business_warehouse:782:*:*:*:*:*:*:*","matchCriteriaId":"929A4FB3-BEEF-4A69-B77C-FD1A0B3C7DFF"},{"vulnerable":true,"criteria":"cpe:2.3:a:sap:bw\\/4hana:100:*:*:*:*:*:*:*","matchCriteriaId":"BCD13072-E149-45FB-BD46-E3D48D81216B"},{"vulnerable":true,"criteria":"cpe:2.3:a:sap:bw\\/4hana:200:*:*:*:*:*:*:*","matchCriteriaId":"704134B4-A642-488F-94B3-48A744C46A1A"}]}]}],"references":[{"url":"http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html","source":"cna@sap.com","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2022/May/42","source":"cna@sap.com","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https://launchpad.support.sap.com/#/notes/2999854","source":"cna@sap.com","tags":["Permissions Required","Vendor Advisory"]},{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476","source":"cna@sap.com","tags":["Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2022/May/42","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https://launchpad.support.sap.com/#/notes/2999854","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Permissions Required","Vendor Advisory"]},{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}}]}