TI-2021-04568 Aliases CVE-2021-21470 GHSA-8xxp-2wxg-r73w

XML external entity injection in SAP EPM Add-in for Microsoft Office

LOW 20CWE-611Published 2021-01-12 · Updated 2024-08-03

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

SAP EPM Add-in for Microsoft Office, version - 1010 and SAP EPM Add-in for SAP Analysis Office, version - 2.8, allows an authenticated attacker with user privileges to parse malicious XML files which could result in XXE-based attacks in applications that accept attacker-controlled XML configuration files. This occurs as logging service does not disable XML external entities when parsing configuration files and a successful exploit would result in limited impact on integrity and availability of the application.

Why it matters now

EPSS 0.00237 14th percentileScored 2026-11-07

Fix Fixed SAP EPM Add-in for Microsoft Office (SAP SE): 1010SAP EPM Add-in for SAP Analysis Office (SAP SE): 2.8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP EPM Add-in for Microsoft Office	before 1010	1010	Patch available	CNA
SAP	SAP EPM Add-in for SAP Analysis Office	before 2.8	2.8	Patch available	CNA

SAP EPM Add-in for Microsoft Office VendorSAP Affected before 1010 Fixed in 1010 Patch available CNA
SAP EPM Add-in for SAP Analysis Office VendorSAP Affected before 2.8 Fixed in 2.8 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:enterprise_performance_management:2.8:::::sap_analysis_office::	2.8	Vulnerable	SAP
cpe:2.3:a:sap:enterprise_performance_management:1010:::::microsoft_office::	1010	Vulnerable	SAP

cpe:2.3:a:sap:enterprise_performance_management:2.8:*:*:*:*:sap_analysis_office:*:* Versions 2.8 Vulnerable ·SAP
cpe:2.3:a:sap:enterprise_performance_management:1010:*:*:*:*:microsoft_office:*:* Versions 1010 Vulnerable ·SAP

Remediation

Fix · CNA SAP EPM Add-in for Microsoft Office (SAP SE) Fixed in 1010
Fix · CNA SAP EPM Add-in for SAP Analysis Office (SAP SE) Fixed in 2.8

Timeline

2026-10-02 Threatist record created from CVE-2021-21470
2026-10-03 Alias added: GHSA-8xxp-2wxg-r73w

References

Advisory 1

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476

Other 1

https://launchpad.support.sap.com/#/notes/3000291

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences