VDB
CVE-2021-21447
CVE-2021-21447
PUBLISHED
CVSS 5.4 MEDIUM
Reported by sap · Published January 12, 2021
SAP BusinessObjects Business Intelligence platform, versions 410, 420, allows an authenticated attacker to inject malicious JavaScript payload into the custom value input field of an Input Control, which can be executed by User who views the relevant application content, which leads to Stored Cross-Site Scripting.
Risk scores
CVSS 3.0
5.4
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP BusinessObjects Business Intelligence platform (Web Intelligence HTML interface) | < 410, < 420 |
| SAP SE | SAP BusinessObjects Business Intelligence platform (Web Intelligence HTML interface) | 0, 0 |
Timeline
- Jan 12, 2021 CVE Published
- Apr 14, 2021 EPSS Score (30 in total, the first dated here)
- Jun 1, 2026 Security Advisory
- Jun 17, 2026 CVE Updated
- Aug 26, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2021-21447
vulnetix vdb fixes CVE-2021-21447Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2021-21447/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart