PT-2020-19038 · Sap · Sap Businessobjects Business Intelligence Platform

Published 2020-05-12 · Updated 2022-10-06 · CVE-2020-6242

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform (Live Data Connect) versions 1.0 through 2.3

Description The issue allows an attacker to logon to the Central Management Console without a password if the BIPRWS application server is not protected with a specific certificate, leading to a missing authentication check.

Recommendations For versions 1.0 through 2.3, ensure the BIPRWS application server is protected with the required specific certificate to prevent unauthorized access to the Central Management Console.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2020-6242

Affected Products

Sap Businessobjects Business Intelligence Platform

References · 5

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6242 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6242 · Vendor Advisory
• https://t.me/cvenotify/3713 · Telegram Post
• https://launchpad.support.sap.com/#/notes/2885244 · Note