SAP bw/4hana vulnerabilities

5 CVEs affecting SAP bw/4hana, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-37176, published 2024-06-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-21466, published 2021-01-12. High severity, CVSS 8.8. EPSS: 3.1% chance of exploitation in the next 30 days. SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow a low privileged attacker to inject code using a remote enabled function module…
CVE-2020-26838, published 2020-12-09. Critical severity, CVSS 9.1. EPSS: 2.2% chance of exploitation in the next 30 days. SAP Business Warehouse, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 782, and SAP BW4HANA, versions - 100, 200 allows an attacker authenticated with (high) developer privileges…
CVE-2019-0243, published 2019-01-08. High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days. Under some circumstances, masterdata maintenance in SAP BW/4HANA (fixed in DW4CORE version 1.0 (SP08)) does not perform necessary authorization checks for an authenticated user, resulting in…
CVE-2023-33992, published 2023-07-11. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. The SAP BW BICS communication layer in SAP Business Warehouse and SAP BW/4HANA - version SAP_BW 730, SAP_BW 731, SAP_BW 740, SAP_BW 730, SAP_BW 750, DW4CORE 100, DW4CORE 200, DW4CORE 300, may expose…
CVE-2024-37176, published 2024-06-11. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. SAP BW/4HANA Transformation and Data Transfer Process (DTP) allows an authenticated attacker to gain higher access levels than they should have by exploiting improper authorization checks. This…