CVE-2020-6208
Last modified
CVE-2020-6208 is a high-severity vulnerability rated 8.2/10 on the CVSS scale. SAP Business Objects Business Intelligence Platform (Crystal Reports), versions- 4.1, 4.2, allows an attacker with basic authorization to inject code that can be executed by the application and thus allowing the attacker to control the behaviour of the application, leading to Remote Code Execution. Although the mode of attack is only Local, multiple applications can be impacted as a result of the vulnerability.. EPSS estimates a 1.14% chance of exploitation in the next 30 days.
Description
SAP Business Objects Business Intelligence Platform (Crystal Reports), versions- 4.1, 4.2, allows an attacker with basic authorization to inject code that can be executed by the application and thus allowing the attacker to control the behaviour of the application, leading to Remote Code Execution. Although the mode of attack is only Local, multiple applications can be impacted as a result of the vulnerability.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sap | Crystal Reports | 4.1 |
| Sap | Crystal Reports | 4.2 |
References
- https://launchpad.support.sap.com/#/notes/2861301Permissions Required
- https://www.zerodayinitiative.com/advisories/ZDI-20-291/Third Party Advisory, VDB Entry
- https://launchpad.support.sap.com/#/notes/2861301Permissions Required
- https://www.zerodayinitiative.com/advisories/ZDI-20-291/Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-6208?
How severe is CVE-2020-6208?
How do I fix CVE-2020-6208?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-6202SAP NetWeaver Application Server Java (User Management Engin…7.2
- CVE-2020-6203SAP NetWeaver UDDI Server (Services Registry), versions- 7.1…9.1
- CVE-2020-6204The selection query in SAP Treasury and Risk Management (Tra…4.3
- CVE-2020-6205SAP NetWeaver AS ABAP Business Server Pages (Smart Forms), S…6.1
- CVE-2020-6206SAP Cloud Platform Integration for Data Services, version 1.…4.3
- CVE-2020-6207SAP Solution Manager (User Experience Monitoring), version- …9.8
- CVE-2020-6209SAP Disclosure Management, version 10.1, does not perform ne…7.5
- CVE-2020-6210SAP Fiori Launchpad, versions- 753, 754, does not sufficient…6.1
- CVE-2020-6211SAP Business Objects Business Intelligence Platform (AdminTo…6.1
- CVE-2020-6212Egypt localized withholding tax reports Clearing of Liabilit…5.4
- CVE-2020-6213SAP NetWeaver AS ABAP Business Server Pages Test Application…6.1
- CVE-2020-6214SAP S/4HANA (Financial Products Subledger), version 100, use…4.7
Are you affected by CVE-2020-6208?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST