XSS in SAP Businessobjects Business Intelligence Platform
CVE-2021-42061
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. This allows a low privileged attacker to retrieve some data from the victim but will never be able to modify the document and publish these modifications to the server. It impacts the "Quick Prompt" workflow.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.005 (37.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 37th percentile — 37.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- SAP Businessobjects Business Intelligence Platform — versions 420
- SAP Se Businessobjects Business Intelligence Platform — versions < 420
Weakness classification (CWE)
References
- launchpad.support.sap.com/ (Permissions Required)
- wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021 (Vendor Advisory)
Frequently asked questions
- What is CVE-2021-42061?
- CVE-2021-42061 is a medium-severity vulnerability in SAP Businessobjects Business Intelligence Platform, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2021-12-14.
- How severe is CVE-2021-42061?
- Medium severity. CVSS v3 base score is 5.4 out of 10.