CVE-2021-33679: sap se sap businessobjects business intelligence platform (bi workspace) Cross-site Scripting

Vulnerability summary

CVE-2021-33679 is a medium (CVSS 5.4) Cross-site Scripting vulnerability in sap se sap businessobjects business intelligence platform (bi workspace). EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.8% of scored vulnerabilities.

Timeline

1. 14-09-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to inject a malicious script while creating a new module document, file, or folder. When another user visits that page, the stored malicious script will execute in their session, hence allowing the attacker to compromise their confidentiality and integrity.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.