PT-2021-20274 · Sap · Sap Businessobjects Business Intelligence Platform

Published 2021-09-15 · Updated 2022-04-25 · CVE-2021-33697

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence Platform (SAPUI5) versions 420, 430

Description: The issue allows an unauthenticated attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities. This occurs under certain conditions, potentially affecting users of the SAP BusinessObjects Business Intelligence Platform.

Recommendations: For versions 420 and 430, consider implementing additional security measures to prevent reverse tabnabbing attacks, such as validating user input and ensuring proper URL handling. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-1022

CWE-269

Related Identifiers

CVE-2021-33697

Affected Products

Sap Businessobjects Business Intelligence Platform

References · 7

• https://osv.dev/vulnerability/CVE-2021-33697 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33697 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3063048 · Note
• https://t.me/cvenotify/20934 · Telegram Post
• https://t.me/cibsecurity/28940 · Telegram Post
• https://t.me/cvenotify/20914 · Telegram Post