{"schemaVersion":3,"id":"CVE-2021-21447","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"SAP BusinessObjects Business Intelligence platform, versions 410, 420, allows an authenticated attacker to inject malicious JavaScript payload into the custom value input field of an Input Control, which can be executed by User who views the relevant application content, which leads to Stored Cross-Site Scripting.","dates":{"published":"2021-01-12T14:40:43.000Z","modified":"2024-08-03T18:16:22.247Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.4,"severity":"medium","version":"3.0","versionLabel":"v3.0","source":"CVE.org","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"CVE.org","score":5.4,"severity":"medium","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.4,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":5.4,"severity":"medium","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":3.5,"severity":"low","vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00536,"percentile":0.4437,"severity":"low","asOf":"2026-10-22T00:00:00.000Z","change":{"pp":0.006999999999999975,"baselineDate":"2026-09-22T00:00:00.000Z","baselineScore":0.00529},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00536,"percentile":0.4437}],"last30":[{"date":"2026-09-22T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00529,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00536,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00536,"percentile":0.4437}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"sap_se","product":"sap businessobjects business intelligence platform (web intelligence html interface)","name":"SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)","label":"sap businessobjects business intelligence platform (web intelligence html interface)","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 410","noFixRecorded":false,"fixedIn":null},{"text":"< 420","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 410 | < 420","eol":null,"hubHref":"/vendor/sap_se/sap_businessobjects_business_intelligence_platform_web_intelligence_html_interface"},{"vendor":"sap","product":"businessobjects_business_intelligence","name":"businessobjects business intelligence","label":"businessobjects_business_intelligence","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"4.10","noFixRecorded":false,"fixedIn":null},{"text":"420","noFixRecorded":false,"fixedIn":null}],"versionsText":"4.10 | 420","eol":null,"hubHref":"/vendor/sap/businessobjects_business_intelligence"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476","label":"wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476","hostname":"wiki.scn.sap.com","tags":["X Refsource MISC","Vendor Advisory"]},{"url":"https://launchpad.support.sap.com/#/notes/2965154","label":"launchpad.support.sap.com","hostname":"launchpad.support.sap.com","tags":["X Refsource MISC","Permissions Required"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2021-01-12T14:40:43.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-03T18:16:22.247Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":22,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T17:20:40.096Z","stale":false,"partial":false}}