Medium severity · published Dec 14, 2021
CVE-2021-42061
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS)…
5.4
CVSS
0.5%
EPSS
No
On KEV
Description
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. This allows a low privileged attacker to retrieve some data from the victim but will never be able to modify the document and publish these modifications to the server. It impacts the "Quick Prompt" workflow.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BB
Businessobjects Business Intelligence Platform · Sap
420 · source: NVD
Affected product
BB
Businessobjects Business Intelligence Platform
Sap
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-42061
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-42061
Permissions Required
https://launchpad.support.sap.com/#/notes/3103677
Vendor Advisory
https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021
More from Businessobjects Business Intelligence Platform
9.8
CVE-2020-6242
SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on the Central Management Console without…
9.8
CVE-2020-6195
SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, leading to Information Disclosure
9.6
CVE-2020-26831
SAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crystal report generation due to missing…
9.3
CVE-2024-28165
Cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform
9.1
CVE-2025-0061
Multiple vulnerabilities in SAP BusinessObjects Business Intelligence Platform