CVE-2021-21444: SAP Businessobjects Business Intelligence

Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days.

SAP Business Objects BI Platform, versions - 410, 420, 430, allows multiple X-Frame-Options headers entries in the response headers, which may not be predictably treated by all user agents. This could, as a result, nullify the added X-Frame-Options header leading to Clickjacking attack.

Affected products

• SAP Businessobjects Business Intelligence: version 410 only; version 420 only; version 430 only

Published 2021-02-09. Last modified 2026-06-17.