PT-2021-22907 · Sap · Sap Businessobjects Business Intelligence Platform

Published 2021-10-12 · Updated 2021-10-18 · CVE-2021-40500

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform (Crystal Reports) versions 420, 430

Description The issue allows an unauthenticated attacker to exploit missing XML validations at endpoints to read sensitive data. These endpoints are normally exposed over the network and successful exploitation can enable the attacker to retrieve arbitrary files from the server.

Recommendations For versions 420 and 430, consider restricting access to the exposed endpoints to minimize the risk of exploitation until a fix is available. As a temporary workaround, disabling the endpoints or implementing additional validation for XML inputs may help mitigate the risk.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2021-40500

Affected Products

Sap Businessobjects Business Intelligence Platform

References · 5

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-40500 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40500 · Security Note
• https://launchpad.support.sap.com/#/notes/3074693 · Note
• https://t.me/cibsecurity/30412 · Telegram Post