PT-2020-2770 · Sap · Sap Businessobjects Business Intelligence Platform

Kdot · Published 2020-03-10 · Updated 2021-07-21 · CVE-2020-6208

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform (Crystal Reports) versions 4.1, 4.2

Description The issue allows an attacker with basic authorization to inject code that can be executed by the application, leading to Remote Code Execution. This can control the behaviour of the application. Although the mode of attack is only Local, multiple applications can be impacted as a result of the issue. The vulnerability is related to errors in code generation management, which can allow an attacker to execute arbitrary code.

Recommendations For versions 4.1 and 4.2, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Code Injection

Use After Free

Weakness Enumeration

CWE-94

CWE-416

Related Identifiers

BDU:2020-02862

CVE-2020-6208

ZDI-20-291

Affected Products

Sap Businessobjects Business Intelligence Platform

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-6208 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6208 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02862 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-291 · Security Note
• https://launchpad.support.sap.com/#/notes/2861301 · Note