by Kastro
Paper/Archive/CVE-2020-6195

CVE-2020-6195

SAP SE SAP Business Objects Business Intelligence Platform — SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, leading to Informa…

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 50.1.501 × 2010.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, leading to Information Disclosure. It involves social engineering in order to gain access to system and If password is known, it would give administrative rights to the attacker to read/modify delete the data and rights within the system.

Affected

ProductAffectedFixed inSource
SAP Business Objects Business Intelligence Platform< 4.1–CNA
SAP Business Objects Business Intelligence Platform< 4.2–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
sap (CNA)6.4CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reflaunchpad.support.sap.com/#/notes/2878507refwiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202