CVE-2021-42061

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

SAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. This allows a low privileged attacker to retrieve some data from the victim but will never be able to modify the document and publish these modifications to the server. It impacts the "Quick Prompt" workflow.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Dec 14, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-420624.3SAP ERP HCM Portugal does not perform necessary authorization checks for a report that reads the payroll data of employees in a certain area CVE-2021-420636.1A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50. The usage of one SAP KW compo CVE-2021-420649.8If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized "in" clause, SAP C CVE-2021-420664.4SAP Business One - version 10.0, allows an admin user to view DB password in plain text over the network, which should otherwise be encrypte CVE-2021-420674.3In SAP NetWeaver AS for ABAP and ABAP Platform - versions 701, 702, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 786, an attacker CVE-2021-420683.3When a user opens a manipulated GIF (.gif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the applic CVE-2021-420693.3When a user opens manipulated Tagged Image File Format (.tif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - vers CVE-2021-42078.2A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header.width` and `cursor->CVE-2021-420703.3When a user opens manipulated Jupiter Tessellation (.jt) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9 CVE-2021-420719.8In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/CVE-2021-420728.8An issue was discovered in Barrier before 2.4.0. The barriers component (aka the server-side implementation of Barrier) does not sufficientl CVE-2021-420738.2An issue was discovered in Barrier before 2.4.0. An attacker can enter an active session state with the barriers component (aka the server-s