CVE-2021-21444
First published: Tue Feb 09 2021(Updated: )
SAP Business Objects BI Platform, versions - 410, 420, 430, allows multiple X-Frame-Options headers entries in the response headers, which may not be predictably treated by all user agents. This could, as a result, nullify the added X-Frame-Options header leading to Clickjacking attack.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP BusinessObjects Business Intelligence | =410 | |
| SAP BusinessObjects Business Intelligence | =420 | |
| SAP BusinessObjects Business Intelligence | =430 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-21444?
CVE-2021-21444 is a vulnerability in SAP Business Objects BI Platform versions 410, 420, and 430 that allows multiple X-Frame-Options headers entries in the response headers, potentially leading to a Clickjacking attack.
What is the severity of CVE-2021-21444?
CVE-2021-21444 has a severity level of medium rated 6.1 according to the Common Vulnerability Scoring System (CVSS).
How does CVE-2021-21444 affect SAP Business Objects BI Platform?
CVE-2021-21444 affects SAP Business Objects BI Platform versions 410, 420, and 430 by allowing multiple X-Frame-Options headers entries in the response headers, which may nullify the added X-Frame-Options header and enable Clickjacking attacks.
How can I fix CVE-2021-21444 in SAP Business Objects BI Platform?
To fix CVE-2021-21444 in SAP Business Objects BI Platform, update to the latest version provided by SAP and follow the recommendations provided in their security advisory.
Where can I find more information about CVE-2021-21444?
You can find more information about CVE-2021-21444 in the SAP support portal: [SAP Note 2935791](https://launchpad.support.sap.com/#/notes/2935791) and the [SAP Community Network (SCN) wiki](https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543).
- collector/nvd-index
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/description
- agent/type
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/sap
- canonical/sap businessobjects business intelligence
- version/sap businessobjects business intelligence/410
- version/sap businessobjects business intelligence/420
- version/sap businessobjects business intelligence/430