Read the docs
TI-2021-04564 Aliases CVE-2021-21466GHSA-xcp4-49mj-2j86

Code injection in SAP Business Warehouse

Priority MEDIUM 44CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-94.

Summary

SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow a low privileged attacker to inject code using a remote enabled function module over the network. Via the function module an attacker can create a malicious ABAP report which could be used to get access to sensitive data, to inject malicious UPDATE statements that could have also impact on the operating system, to disrupt the functionality of the SAP system which can thereby lead to a Denial of Service.

Why it matters now

EPSS 0.03116 87th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed SAP Business Warehouse (SAP SE): 700, 701, 702 +6SAP BW/4HANA (SAP SE): 100, 200

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP Business Warehousebefore 700; before 701; before 702; before 711; before 730; before 731; before 740; before 750; before 782700, 701, 702, 711, 730, 731, 740, 750, 782Patch availableCNA
SAPSAP BW/4HANAbefore 100; before 200100, 200Patch availableCNA
  • SAP Business Warehouse VendorSAP Affected before 700; before 701; before 702; before 711; before 730; before 731; before 740; before 750; before 782 Fixed in 700, 701, 702, 711, 730, 731, 740, 750, 782 Patch available CNA
  • SAP BW/4HANA VendorSAP Affected before 100; before 200 Fixed in 100, 200 Patch available CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:sap:business_warehouse:700:*:*:*:*:*:*:*700VulnerableSAP
cpe:2.3:a:sap:business_warehouse:701:*:*:*:*:*:*:*701VulnerableSAP
cpe:2.3:a:sap:business_warehouse:702:*:*:*:*:*:*:*702VulnerableSAP
cpe:2.3:a:sap:business_warehouse:711:*:*:*:*:*:*:*711VulnerableSAP
cpe:2.3:a:sap:business_warehouse:730:*:*:*:*:*:*:*730VulnerableSAP
cpe:2.3:a:sap:business_warehouse:731:*:*:*:*:*:*:*731VulnerableSAP
cpe:2.3:a:sap:business_warehouse:740:*:*:*:*:*:*:*740VulnerableSAP
cpe:2.3:a:sap:business_warehouse:750:*:*:*:*:*:*:*750VulnerableSAP
cpe:2.3:a:sap:business_warehouse:782:*:*:*:*:*:*:*782VulnerableSAP
cpe:2.3:a:sap:bw\/4hana:100:*:*:*:*:*:*:*100VulnerableSAP
  • cpe:2.3:a:sap:business_warehouse:700:*:*:*:*:*:*:* Versions 700 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_warehouse:701:*:*:*:*:*:*:* Versions 701 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_warehouse:702:*:*:*:*:*:*:* Versions 702 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_warehouse:711:*:*:*:*:*:*:* Versions 711 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_warehouse:730:*:*:*:*:*:*:* Versions 730 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_warehouse:731:*:*:*:*:*:*:* Versions 731 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_warehouse:740:*:*:*:*:*:*:* Versions 740 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_warehouse:750:*:*:*:*:*:*:* Versions 750 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_warehouse:782:*:*:*:*:*:*:* Versions 782 Vulnerable ·SAP
  • cpe:2.3:a:sap:bw\/4hana:100:*:*:*:*:*:*:* Versions 100 Vulnerable ·SAP
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sap:bw\/4hana:200:*:*:*:*:*:*:*200VulnerableSAP
  • cpe:2.3:a:sap:bw\/4hana:200:*:*:*:*:*:*:* Versions 200 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP Business Warehouse (SAP SE) Fixed in 700, 701, 702, 711, 730, 731, 740, 750, 782
  • Fix · CNA SAP BW/4HANA (SAP SE) Fixed in 100, 200

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21466
  2. 2026-10-03 Alias added: GHSA-xcp4-49mj-2j86

References

Exploit 2

Advisory 2

  • TI-2021-04563 SQL injection in SAP Business Warehouse CVSS 3.1CRITICAL 9.9
  • TI-2020-16301 OS command injection in SAP Business Warehouse CVSS 3.1CRITICAL 9.1
  • TI-2021-04566 Missing authorization in SAP Business Warehouse CVSS 3.1MEDIUM 6.5
  • TI-2023-16859 Missing Authorization Check in SAP Business Warehouse and SAP BW/4HANA CVSS 3.1MEDIUM 6.5
  • TI-2024-26524 Cross-site scripting in SAP Business Warehouse - Business Planning and Simulation CVSS 3.1MEDIUM 6.1
  • TI-2024-26525 Cross-site scripting in SAP Business Warehouse - Business Planning and Simulation CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences