CVE-2021-33667

3 documents3 sources

Severity

4.3MEDIUM

EPSS

0.2%

top 63.61%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

SAP SE SAP Business Objects WEB Intelligence (BI Launchpad)SAP Businessobjects WEB Intelligence

Timeline

PublishedJul 14

Latest updateMay 24

Description

Under certain conditions, SAP Business Objects Web Intelligence (BI Launchpad) versions - 420, 430, allows an attacker to access jsp source code, through SDK calls, of Analytical Reporting bundle, a part of the frontend application, which would otherwise be restricted.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5sap_se/sap_business_objects_web_intelligence_(bi_launchpad)< 420+1

▶NVDsap/businessobjects_web_intelligence420, 430+1

🔴Vulnerability Details

GHSA

GHSA-4qv2-qrrg-4f85: Under certain conditions, SAP Business Objects Web Intelligence (BI Launchpad) versions - 420, 430, allows an attacker to access jsp source code, thro↗2022-05-24

▶

CVEList

CVE-2021-33667: Under certain conditions, SAP Business Objects Web Intelligence (BI Launchpad) versions - 420, 430, allows an attacker to access jsp source code, thro↗2021-07-14

▶