CVE-2021-21447: XSS

Published Jan 12, 2021

Updated

SAP BusinessObjects Business Intelligence platform, versions 410, 420, allows an authenticated attacker to inject malicious JavaScript payload into the custom value input field of an Input Control, which can be executed by User who views the relevant application content, which leads to Stored Cross-Site Scripting.

Affected Software

2 affected components

SAP BusinessObjects Business Intelligence=410

SAP BusinessObjects Business Intelligence=420

Event History

Jan 12, 2021

CVE Published

via MITRE·02:40 PM

Data Sourced

via MITRE·02:40 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2021-21447.

What is the severity of CVE-2021-21447?

The severity of CVE-2021-21447 is medium.

How can an attacker exploit this vulnerability?

An attacker can exploit this vulnerability by injecting a malicious JavaScript payload into the custom value input field of an Input Control in SAP BusinessObjects Business Intelligence platform versions 410 and 420.

Who is affected by CVE-2021-21447?

Users of SAP BusinessObjects Business Intelligence platform versions 410 and 420 are affected by CVE-2021-21447.

Are there any fixes or patches available for CVE-2021-21447?

Yes, SAP has provided fixes and patches for CVE-2021-21447. Please refer to the following references for more information: [link1](https://launchpad.support.sap.com/#/notes/2965154) and [link2](https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476).