Vulnerability · Published Sep 14, 2021 · Assigned by sap
CVE-2021-33679
Medium 5.4
In plain English
A medium-severity security flaw in SAP BusinessObjects Business Intelligence Platform (BI Workspace) from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Severity (CVSS 3.0)5.4Medium
Exploit odds (30 days)0.5%top 58.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to inject a malicious script while creating a new module document, file, or folder. When another user visits that page, the stored malicious script will execute in their session, hence allowing the attacker to compromise their confidentiality and integrity.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP BusinessObjects Business Intelligence Platform (BI Workspace) | < 420 |
References
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 x_refsource_MISC
- https://launchpad.support.sap.com/#/notes/3055180 x_refsource_MISC