CVE-2021-21466

SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow a low privileged attacker to inject code using a remote enabled function module over the network. Via the function module an attacker can create a malicious ABAP report which could be used to get access to sensitive data, to inject malicious UPDATE statements that could have also impact on the operating system, to disrupt the functionality of the SAP system which can thereby lead to a Denial of Service.

• CWE-94

• http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/May/42Exploit, Mailing List, Third Party Advisory
• https://launchpad.support.sap.com/#/notes/2999854Permissions Required, Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476Vendor Advisory
• http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/May/42Exploit, Mailing List, Third Party Advisory
• https://launchpad.support.sap.com/#/notes/2999854Permissions Required, Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476Vendor Advisory

Published

Jan 12, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-21460SAP 3D Visual Enterprise Viewer, version - 9, allows a user …8.8
• CVE-2021-21461SAP 3D Visual Enterprise Viewer, version - 9, allows a user …8.8
• CVE-2021-21462SAP 3D Visual Enterprise Viewer, version - 9, allows a user …8.8
• CVE-2021-21463SAP 3D Visual Enterprise Viewer, version - 9, allows a user …8.8
• CVE-2021-21464SAP 3D Visual Enterprise Viewer, version - 9, allows a user …4.3
• CVE-2021-21465The BW Database Interface allows an attacker with low privil…9.9
• CVE-2021-21467SAP Banking Services (Generic Market Data) does not perform …4.3
• CVE-2021-21468The BW Database Interface does not perform necessary authori…6.5
• CVE-2021-21469When security guidelines for SAP NetWeaver Master Data Manag…7.5
• CVE-2021-2147Vulnerability in the Oracle ZFS Storage Appliance Kit produc…1.8
• CVE-2021-21470SAP EPM Add-in for Microsoft Office, version - 1010 and SAP …4.4
• CVE-2021-21471In CLA-Assistant, versions before 2.8.5, due to improper acc…6.5