CVE-2021-33667: 
SAP BusinessObjects Web Intelligence vulnerability analysis and mitigation

CVE-2021-33667 is a security vulnerability affecting SAP Business Objects Web Intelligence (BI Launchpad) versions 420 and 430. The vulnerability was disclosed on July 14, 2021, and allows an attacker to access JSP source code of the Analytical Reporting bundle through SDK calls, which should normally be restricted (AttackerKB, CERT-FR).

The vulnerability exists in the SDK calls functionality of SAP Business Objects Web Intelligence's frontend application, specifically in the Analytical Reporting bundle. When exploited, it allows unauthorized access to JSP (JavaServer Pages) source code that should be protected. The attack vector is through the network, requires low privileges, and does not need user interaction for exploitation (CISA).

The successful exploitation of this vulnerability could lead to unauthorized access to sensitive application source code. This could potentially expose internal application logic, security mechanisms, and other confidential implementation details that should remain private (CERT-FR).

The vulnerability requires low privileges to exploit and does not need user interaction, making it relatively straightforward to exploit for attackers who have basic access to the system. The attack can be executed through network access (AttackerKB).

SAP has released security patches to address this vulnerability. Organizations using affected versions of SAP Business Objects Web Intelligence (BI Launchpad) versions 420 and 430 should apply the appropriate security updates (CERT-FR).