Vulnerability · Published Feb 9, 2021 · Assigned by sap
CVE-2021-21444
Medium 5.4
In plain English
A medium-severity security flaw in SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad) from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Severity (CVSS 3.0)5.4Medium
Exploit odds (30 days)0.8%top 42.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
SAP Business Objects BI Platform, versions - 410, 420, 430, allows multiple X-Frame-Options headers entries in the response headers, which may not be predictably treated by all user agents. This could, as a result, nullify the added X-Frame-Options header leading to Clickjacking attack.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad) | < 410< 420< 430 |
References
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543 x_refsource_MISC
- https://launchpad.support.sap.com/#/notes/2935791 x_refsource_MISC