Read the docs
TI-2021-04566 Aliases CVE-2021-21468GHSA-vv8p-qf65-j73w

Missing authorization in SAP Business Warehouse

Priority LOW 33CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges that allows the user to practically read out any database table.

Why it matters now

EPSS 0.01919 80th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed SAP Business Warehouse (SAP SE): 710, 711, 730 +9

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP Business Warehousebefore 710; before 711; before 730; before 731; before 740; before 750; before 751; before 752; before 753; before 754; before 755; before 782710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 782Patch availableCNA
  • SAP Business Warehouse VendorSAP Affected before 710; before 711; before 730; before 731; before 740; before 750; before 751; before 752; before 753; before 754; before 755; before 782 Fixed in 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 782 Patch available CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:sap:business_warehouse:710:*:*:*:*:*:*:*710VulnerableSAP
cpe:2.3:a:sap:business_warehouse:711:*:*:*:*:*:*:*711VulnerableSAP
cpe:2.3:a:sap:business_warehouse:730:*:*:*:*:*:*:*730VulnerableSAP
cpe:2.3:a:sap:business_warehouse:731:*:*:*:*:*:*:*731VulnerableSAP
cpe:2.3:a:sap:business_warehouse:740:*:*:*:*:*:*:*740VulnerableSAP
cpe:2.3:a:sap:business_warehouse:750:*:*:*:*:*:*:*750VulnerableSAP
cpe:2.3:a:sap:business_warehouse:751:*:*:*:*:*:*:*751VulnerableSAP
cpe:2.3:a:sap:business_warehouse:752:*:*:*:*:*:*:*752VulnerableSAP
cpe:2.3:a:sap:business_warehouse:753:*:*:*:*:*:*:*753VulnerableSAP
cpe:2.3:a:sap:business_warehouse:754:*:*:*:*:*:*:*754VulnerableSAP
  • cpe:2.3:a:sap:business_warehouse:710:*:*:*:*:*:*:* Versions 710 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_warehouse:711:*:*:*:*:*:*:* Versions 711 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_warehouse:730:*:*:*:*:*:*:* Versions 730 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_warehouse:731:*:*:*:*:*:*:* Versions 731 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_warehouse:740:*:*:*:*:*:*:* Versions 740 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_warehouse:750:*:*:*:*:*:*:* Versions 750 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_warehouse:751:*:*:*:*:*:*:* Versions 751 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_warehouse:752:*:*:*:*:*:*:* Versions 752 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_warehouse:753:*:*:*:*:*:*:* Versions 753 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_warehouse:754:*:*:*:*:*:*:* Versions 754 Vulnerable ·SAP
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sap:business_warehouse:755:*:*:*:*:*:*:*755VulnerableSAP
cpe:2.3:a:sap:business_warehouse:782:*:*:*:*:*:*:*782VulnerableSAP
  • cpe:2.3:a:sap:business_warehouse:755:*:*:*:*:*:*:* Versions 755 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_warehouse:782:*:*:*:*:*:*:* Versions 782 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP Business Warehouse (SAP SE) Fixed in 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 782

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21468
  2. 2026-10-03 Alias added: GHSA-vv8p-qf65-j73w

References

Exploit 2

Advisory 2

  • TI-2021-04563 SQL injection in SAP Business Warehouse CVSS 3.1CRITICAL 9.9
  • TI-2021-04564 Code injection in SAP Business Warehouse CVSS 3.1HIGH 8.8
  • TI-2020-16301 OS command injection in SAP Business Warehouse CVSS 3.1CRITICAL 9.1
  • TI-2023-16859 Missing Authorization Check in SAP Business Warehouse and SAP BW/4HANA CVSS 3.1MEDIUM 6.5
  • TI-2024-26524 Cross-site scripting in SAP Business Warehouse - Business Planning and Simulation CVSS 3.1MEDIUM 6.1
  • TI-2024-26525 Cross-site scripting in SAP Business Warehouse - Business Planning and Simulation CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences