What is CVE-2021-42061?

CVE-2021-42061 is a medium-severity vulnerability in SAP Businessobjects Business Intelligence Platform, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2021-12-14.

How severe is CVE-2021-42061?

Medium severity. CVSS v3 base score is 5.4 out of 10.

XSS in SAP Businessobjects Business Intelligence Platform

CVE-2021-42061

SAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. This allows a low privileged attacker to retrieve some data from the victim but will never be able to modify the document and publish these modifications to the server. It impacts the "Quick Prompt" workflow.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.005 (37.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

Sap Businessobjects_business_intelligence_platform — versions 420
Sap Se Businessobjects Business Intelligence Platform — versions < 420

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

cna@sap.com (Permissions Required, x_refsource_MISC)
cna@sap.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-42061?: CVE-2021-42061 is a medium-severity vulnerability in SAP Businessobjects Business Intelligence Platform, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2021-12-14.
How severe is CVE-2021-42061?: Medium severity. CVSS v3 base score is 5.4 out of 10.