by Kastro
Paper/Archive/CVE-2020-6219

CVE-2020-6219

SAP SE SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer) — SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Reports for VS versio…

EPSS 1%CVSS 9.1
critical.is priorityof 100
42
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 71.7.717 × 2014.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Reports for VS version 2010, allows an attacker with basic authorization to perform deserialization attack in the application, leading to service interruptions and denial of service and unauthorized execution of arbitrary commands, leading to Deserialization of Untrusted Data.

Affected

ProductAffectedFixed inSource
SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer)< 4.1–CNA
SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer)< 4.2–CNA
Crystal Reports for VS< 2010–CNA

Scores by source

sap (CNA)9.1CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H

References

refwiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202reflaunchpad.support.sap.com/#/notes/2863731