description: SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow a low privileged attacker to inject code using a remote enabled function module over the network. Via the function module an attacker can create a malicious ABAP report which could be used to get access to sensitive data, to inject malicious UPDATE statements that could have also impact on the operating system, to disrupt the functionality of the SAP system which can thereby lead to a Denial of Service.
problem types: Code Injection
affected:
{
product: SAP Business Warehouse
vendor: SAP SE
versions:
status: affected, version: < 700
status: affected, version: < 701
status: affected, version: < 702
status: affected, version: < 711
status: affected, version: < 730
status: affected, version: < 731
status: affected, version: < 740
status: affected, version: < 750
status: affected, version: < 782
}
{
product: SAP BW/4HANA
vendor: SAP SE
versions:
status: affected, version: < 100
status: affected, version: < 200
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.0
]