PT-2020-19018 · Sap · Sap Businessobjects Business Intelligence Platform+1

Published 2020-04-14 · Updated 2020-04-15 · CVE-2020-6219

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer) versions 4.1 through 4.2 Crystal Reports for VS version 2010

Description The issue allows an attacker with basic authorization to perform a deserialization attack in the application. This can lead to service interruptions, denial of service, and unauthorized execution of arbitrary commands, resulting in Deserialization of Untrusted Data.

Recommendations For SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer) versions 4.1 through 4.2, consider restricting access to the deserialization functionality until a patch is available. For Crystal Reports for VS version 2010, consider disabling the vulnerable component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2020-6219

Affected Products

Crystal Reports For Vs

Sap Businessobjects Business Intelligence Platform

References · 5

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2863731 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-6219 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6219 · Security Note
• https://t.me/cvenotify/2721 · Telegram Post