PT-2020-19070 · Sap · Sap Businessobjects Business Intelligence Platform

Published 2020-07-14 · Updated 2020-07-14 · CVE-2020-6278

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC) versions 4.1, 4.2

Description The issue allows an attacker to embed malicious scripts in the application while uploading images. These scripts get executed when the victim opens the affected files, leading to Stored Cross Site Scripting.

Recommendations For versions 4.1 and 4.2, consider restricting image upload functionality until a fix is available. As a temporary workaround, avoid opening files from untrusted sources to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-6278

Affected Products

Sap Businessobjects Business Intelligence Platform

References · 5

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-6278 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6278 · Security Note
• https://launchpad.support.sap.com/#/notes/2912708 · Vendor Advisory
• https://t.me/cvenotify/4999 · Telegram Post