CVE-2016-6818
CriticalSummary
SQL injection vulnerability in SAP Business Intelligence platform before January 2017 allows remote attackers to obtain sensitive information, modify data, cause a denial of service (data deletion), or launch administrative operations or possibly OS commands via a crafted SQL query.
Risk Assessment
The organization may be exposed to data loss, unauthorized modifications, and attacks that could lead to system downtime.
Recommendation
It is recommended to update to the latest version of the SAP Business Intelligence platform and apply the patches provided in SAP Security Note 2361633.
Original NVD description (English source)
SQL injection vulnerability in SAP Business Intelligence platform before January 2017 allows remote attackers to obtain sensitive information, modify data, cause a denial of service (data deletion), or launch administrative operations or possibly OS commands via a crafted SQL query. The vendor response is SAP Security Note 2361633.