PT-2020-5167 · Sap · Sap Businessobjects Business Intelligence Platform

Published 2020-08-12 · Updated 2020-08-13 · CVE-2020-6300

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform versions 4.2, 4.3

Description The issue exists due to insufficient protection of the web page structure, allowing a remote attacker to conduct Cross-Site Scripting (XSS) attacks. An attacker with administrator rights can use the web application to send malicious code to a different end user, as it does not sufficiently encode user-controlled inputs for RecycleBin, resulting in Stored Cross-Site Scripting (XSS).

Recommendations For versions 4.2 and 4.3, ensure that user-controlled inputs for RecycleBin are properly encoded to prevent Stored Cross-Site Scripting (XSS) attacks. As a temporary workaround, consider restricting access to the RecycleBin feature until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-05778

CVE-2020-6300

Affected Products

Sap Businessobjects Business Intelligence Platform

References · 6

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05778 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-6301 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6300 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6300 · Security Note
• https://launchpad.support.sap.com/#/notes/2925827 · Note