CVE-2021-33679

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to inject a malicious script while creating a new module document, file, or folder. When another user visits that page, the stored malicious script will execute in their session, hence allowing the attacker to compromise their confidentiality and integrity.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SAP SE	SAP BusinessObjects Business Intelligence Platform (BI Workspace)	< 420

References

https://launchpad.support.sap.com/#/notes/3055180Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405Vendor Advisory
https://launchpad.support.sap.com/#/notes/3055180Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405Vendor Advisory

Timeline

Published: Sep 14, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-336806.5SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which causes buffer CVE-2021-336816.5SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which causes out of CVE-2021-336825.4SAP Lumira Server version 2.4 does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Th CVE-2021-336834.3SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22 CVE-2021-336845.3SAP NetWeaver AS ABAP and ABAP Platform, versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC CVE-2021-336856.5SAP Business One version - 10.0 allows low-level authorized attacker to traverse the file system to access files or directories that are out CVE-2021-336865.3Under certain conditions, SAP Business One version - 10.0, allows an unauthorized attacker to get access to some encrypted sensitive informa CVE-2021-336874.9SAP NetWeaver AS JAVA (Enterprise Portal), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 reveals sensitive information in one of their HTTP CVE-2021-336884.3SAP Business One allows an attacker with business privileges to execute crafted database queries, exposing the back-end database. Due to fra CVE-2021-336894.3When user with insufficient privileges tries to access any application in SAP NetWeaver Administrator (Administrator applications), version CVE-2021-336909.9Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service v CVE-2021-336916.1NWDI Notification Service versions - 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scriptin