CVE-2021-21447: sap_se sap businessobjects business intelligence platform (web intelligence html interface) Cross-site Scripting

Vulnerability summary

CVE-2021-21447 is a medium (CVSS 5.4) Cross-site Scripting vulnerability in sap_se sap businessobjects business intelligence platform (web intelligence html interface). EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 44.3% of scored vulnerabilities.

Timeline

1. 12-01-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

SAP BusinessObjects Business Intelligence platform, versions 410, 420, allows an authenticated attacker to inject malicious JavaScript payload into the custom value input field of an Input Control, which can be executed by User who views the relevant application content, which leads to Stored Cross-Site Scripting.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.