CVE-2021-21444

5.4MEDIUM

Key Information:

Vendor
SAP
Status
SAP Business Objects Business Intelligence Platform (cmc And Bi LauncHPad)
Vendor
CVE Published:
9 February 2021

Summary

SAP Business Objects BI Platform, versions - 410, 420, 430, allows multiple X-Frame-Options headers entries in the response headers, which may not be predictably treated by all user agents. This could, as a result, nullify the added X-Frame-Options header leading to Clickjacking attack.

Affected Version(s)

SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad) < 410 < 410

SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad) < 420 < 420

SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad) < 430 < 430

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2935791
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.