CVE-2020-6219

9.1CRITICAL

Key Information:

Vendor
SAP
Status
SAP Business Objects Business Intelligence Platform (crystalreports Webform Viewer)
Crystal Reports For Vs
Vendor
CVE Published:
14 April 2020

Summary

SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Reports for VS version 2010, allows an attacker with basic authorization to perform deserialization attack in the application, leading to service interruptions and denial of service and unauthorized execution of arbitrary commands, leading to Deserialization of Untrusted Data.

Affected Version(s)

Crystal Reports for VS < 2010

SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer) < 4.1 < 4.1

SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer) < 4.2 < 4.2

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2863731
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.