NVD Vulnerability Detail

CVE-2021-21468

Summary	The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges that allows the user to practically read out any database table.
Publication Date	Jan. 13, 2021, 12:15 a.m.
Registration Date	Jan. 26, 2021, 12:14 p.m.
Last Update	Nov. 21, 2024, 2:48 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html	Exploit Third Party Advisory VDB Entry
2	http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html	Exploit Third Party Advisory VDB Entry
3	http://seclists.org/fulldisclosure/2022/May/42	Exploit Mailing List Third Party Advisory
4	http://seclists.org/fulldisclosure/2022/May/42	Exploit Mailing List Third Party Advisory
5	https://launchpad.support.sap.com/#/notes/2986980	Permissions Required Vendor Advisory
6	https://launchpad.support.sap.com/#/notes/2986980	Permissions Required Vendor Advisory
7	https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476	Vendor Advisory
8	https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-862	認証の欠如	https://cwe.mitre.org/data/definitions/862.html

JVN Vulnerability Information

BW Database Interface における認証の欠如に関する脆弱性

Title	BW Database Interface における認証の欠如に関する脆弱性
Summary	BW Database Interface には、認証の欠如に関する脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Jan. 12, 2021, midnight
Registration Date	Sept. 15, 2021, 5:58 p.m.
Last Update	Sept. 15, 2021, 5:58 p.m.

Affected System

SAP

Business Warehouse

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-21468	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21468
National Vulnerability Database (NVD)
2	CVE-2021-21468	https://nvd.nist.gov/vuln/detail/CVE-2021-21468

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-862	https://cwe.mitre.org/data/definitions/862.html

ベンダー情報

No	Name	URL
SAP Security Patch Day
1	SAP Security Patch Day - January 2021	https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476

Change Log

No	Changed Details	Date of change
1	[2021年09月15日] 掲載	Sept. 15, 2021, 5:58 p.m.