CVE-2021-40497

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

SAP BusinessObjects Analysis (edition for OLAP) - versions 420, 430, allows an attacker to exploit certain application endpoints to read sensitive data. These endpoints are normally exposed over the network and successful exploitation could lead to exposure of some system specific data like its version.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-668

Affected software

Vendor	Product	Versions
SAP SE	SAP BusinessObjects Analysis, (edition for OLAP)	< 420; < 430

References

https://launchpad.support.sap.com/#/notes/3098917Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983Vendor Advisory
https://launchpad.support.sap.com/#/notes/3098917Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983Vendor Advisory

Timeline

Published: Oct 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-404985.5A vulnerability has been identified in SAP SuccessFactors Mobile Application for Android - versions older than 2108, which allows an attacke CVE-2021-404999.8Client-side printing services SAP Cloud Print Manager and SAPSprint for SAP NetWeaver Application Server for ABAP - versions 7.70, 7.70 PI, CVE-2021-40506.1livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-405007.5SAP BusinessObjects Business Intelligence Platform (Crystal Reports) - versions 420, 430, allows an unauthenticated attacker to exploit miss CVE-2021-405018.1SAP ABAP Platform Kernel - versions 7.77, 7.81, 7.85, 7.86, does not perform necessary authorization checks for an authenticated business us CVE-2021-405028.8SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, result CVE-2021-405037.8An information disclosure vulnerability exists in SAP GUI for Windows - versions < 7.60 PL13, 7.70 PL4, which allows an attacker with suffic CVE-2021-405044.9A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 75 CVE-2021-405069.8An issue was discovered in the ALU unit of the OR1200 (aka OpenRISC 1200) processor 2011-09-10 through 2015-11-11. The overflow flag is not CVE-2021-405079.8An issue was discovered in the ALU unit of the OR1200 (aka OpenRISC 1200) processor 2011-09-10 through 2015-11-11. The overflow flag is not CVE-2021-405095.4ViewCommon.java in JForum2 2.7.0 allows XSS via a user signature.CVE-2021-405107.5XML eXternal Entity (XXE) in OBDA systems’ Mastro 1.0 allows remote attackers to read system files via custom DTDs.