UPDATE 9th February 2021: This note has been re-released with updated ‘validity’, and ‘Support Packages & Patches’ information. The note was enhanced to BW releases from BW 7.0x

UPDATE 26th January 2021: This note has been re-released with updated ‘validity’, and ‘Support Packages & Patches’ information. We enhanced the validity for all covered codelines to the lowest possible SP-level.

This SAP Security Note addresses vulnerabilities identified in SAP Business Warehouse Database Interface. The vulnerability details along with their CVE relevant information can be found below.

SQL Injection

The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the database will execute without properly sanitizing the untrusted data leading to SQL injection vulnerability which can fully compromise the affected SAP system

• CVE-2021-21465
• CVSS Score: 9.9; CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Missing Authorization check

The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges that allows the user to practically read out any database table.

• CVE-2021-21468
• CVSS Score: 6.5; CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N