CVEvulnerability

CVE-2004-0204

7.5 HIGH Published 2004-08-06 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2004-08-06
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers to read and delete arbitrary files via ".." sequences in the dynamicimag argument to crystalimagehandler.aspx.

Affected configurations

• bea weblogic server 8.1 • borland software j builder • businessobjects crystal enterprise 9 • businessobjects crystal enterprise 10 • businessobjects crystal enterprise java sdk 8.5 • businessobjects crystal enterprise ras 8.5 • businessobjects crystal reports 9 • businessobjects crystal reports 10 • microsoft business solutions crm 1.2 • microsoft outlook 2003 • microsoft visual studio .net 2003

References