by Kastro
Paper/Archive/CVE-2020-6242

CVE-2020-6242

SAP SE SAP Business Objects Business Intelligence Platform (Live Data Connect) — SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on…

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 58.0.580 × 2011.6No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on the Central Management Console without password in case of the BIPRWS application server was not protected with some specific certificate, leading to Missing Authentication Check.

Affected

ProductAffectedFixed inSource
SAP Business Objects Business Intelligence Platform (Live Data Connect)< 1.0–CNA
SAP Business Objects Business Intelligence Platform (Live Data Connect)< 2.0–CNA
SAP Business Objects Business Intelligence Platform (Live Data Connect)< 2.x–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
sap (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refwiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222reflaunchpad.support.sap.com/#/notes/2885244