PT-2021-14512 · Sap · Sap Businessobjects Bi Platform

Published 2021-02-09 · Updated 2021-02-16 · CVE-2021-21444

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Business Objects BI Platform versions 410 through 430

Description The issue allows multiple X-Frame-Options headers entries in the response headers, which may not be predictably treated by all user agents. This could nullify the added X-Frame-Options header, leading to a Clickjacking attack.

Recommendations For SAP Business Objects BI Platform versions 410 through 430, consider restricting the use of multiple X-Frame-Options headers entries in the response headers to minimize the risk of Clickjacking attacks. As a temporary workaround, ensure that only one X-Frame-Options header is used in the response headers until a more permanent solution is available.

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2021-21444

Affected Products

Sap Businessobjects Bi Platform

References · 5

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21444 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21444 · Security Note
• https://t.me/cvenotify/9979 · Telegram Post
• https://launchpad.support.sap.com/#/notes/2935791 · Note