CVEvulnerability
CVE-2020-6208
8.2 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-03-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.2 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 4.4 MEDIUM — AV:L/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-416
Description
SAP Business Objects Business Intelligence Platform (Crystal Reports), versions- 4.1, 4.2, allows an attacker with basic authorization to inject code that can be executed by the application and thus allowing the attacker to control the behaviour of the application, leading to Remote Code Execution. Although the mode of attack is only Local, multiple applications can be impacted as a result of the vulnerability.
Affected configurations
• sap crystal reports 4.1
• sap crystal reports 4.2
Related
Weakness · CWE (1)
- CWE-416 Use After Free weakness
References
- https://launchpad.support.sap.com/#/notes/2861301 Permissions Required
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305 Vendor Advisory
- https://www.zerodayinitiative.com/advisories/ZDI-20-291/ Third Party Advisory, VDB Entry
- https://launchpad.support.sap.com/#/notes/2861301 Permissions Required
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305 Vendor Advisory
- https://www.zerodayinitiative.com/advisories/ZDI-20-291/ Third Party Advisory, VDB Entry