Deserialization Vulnerability in SAP Business Objects Business Intelligence Platform
CVE-2020-6219

9.1CRITICAL

Key Information:

Vendor
SAP
Status
SAP Business Objects Business Intelligence Platform (crystalreports Webform Viewer)
Crystal Reports For Vs
Vendor
CVE Published:
14 April 2020

Summary

SAP Business Objects Business Intelligence Platform's CrystalReports WebForm Viewer suffers from a vulnerability that allows an attacker with basic authorization to exploit a deserialization flaw. This attack can lead to service interruptions, denial of service, and the unauthorized execution of arbitrary commands. It's essential to ensure that applications are protected against such threats to maintain their reliability and security.

Affected Version(s)

Crystal Reports for VS < 2010

SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer) < 4.1 < 4.1

SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer) < 4.2 < 4.2

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2863731
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.