SAP Business Warehouse vulnerabilities

7 CVEs affecting SAP Business Warehouse, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-39595, published 2024-07-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-21465, published 2021-01-12. Critical severity, CVSS 9.9. EPSS: 3.7% chance of exploitation in the next 30 days. The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the…
CVE-2021-21466, published 2021-01-12. High severity, CVSS 8.8. EPSS: 3.1% chance of exploitation in the next 30 days. SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow a low privileged attacker to inject code using a remote enabled function module…
CVE-2020-26838, published 2020-12-09. Critical severity, CVSS 9.1. EPSS: 2.2% chance of exploitation in the next 30 days. SAP Business Warehouse, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 782, and SAP BW4HANA, versions - 100, 200 allows an attacker authenticated with (high) developer privileges…
CVE-2021-21468, published 2021-01-12. Medium severity, CVSS 6.5. EPSS: 1.9% chance of exploitation in the next 30 days. The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges that allows the user to practically read out any database…
CVE-2023-33992, published 2023-07-11. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. The SAP BW BICS communication layer in SAP Business Warehouse and SAP BW/4HANA - version SAP_BW 730, SAP_BW 731, SAP_BW 740, SAP_BW 730, SAP_BW 750, DW4CORE 100, DW4CORE 200, DW4CORE 300, may expose…
CVE-2024-39594, published 2024-07-09. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability.…
CVE-2024-39595, published 2024-07-09. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user-controlled inputs, resulting in Stored Cross-Site Scripting (XSS) vulnerability.…