Skip to main content

Businessobjects Business Intelligence Platform CVE-2020-6219

HIGH
Deserialization of Untrusted Data (CWE-502)
2020-04-14 cna@sap.com
SAP Denial Of Service Deserialization Businessobjects Business Intelligence Platform Crystal Reports For Visual Studio
8.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Apr 14, 2020 - 19:15 nvd
HIGH 8.8

DescriptionNVD

SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Reports for VS version 2010, allows an attacker with basic authorization to perform deserialization attack in the application, leading to service interruptions and denial of service and unauthorized execution of arbitrary commands, leading to Deserialization of Untrusted Data.

AnalysisAI

SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Reports for VS version 2010, allows an attacker with basic authorization to perform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Deserialization of Untrusted Data (CWE-502), which allows attackers to execute arbitrary code through malicious serialized objects. SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Reports for VS version 2010, allows an attacker with basic authorization to perform deserialization attack in the application, leading to service interruptions and denial of service and unauthorized execution of arbitrary commands, leading to Deserialization of Untrusted Data. Affected products include: Sap Businessobjects Business Intelligence Platform, Sap Crystal Reports For Visual Studio. Version information: version 2010.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Avoid deserializing untrusted data. Use safe serialization formats (JSON). Implement integrity checks and type allowlists.

More in Businessobjects Business Intelligence Platform

View all
CVE-2022-28213 HIGH POC
8.1 Apr 12

When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does n
CVE-2020-6242 CRITICAL
9.8 May 12

SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an att
CVE-2020-6195 CRITICAL
9.8 Apr 14

SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, l
CVE-2020-26831 CRITICAL
9.6 Dec 09

SAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML

CVE-2024-28165 CRITICAL
9.3 May 14

SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to manipulate a par
CVE-2020-6308 MEDIUM POC
5.3 Oct 20

SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated at
CVE-2023-24530 CRITICAL
9.1 Feb 14

SAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an authenticated admin user to uplo
CVE-2020-6294 CRITICAL
9.1 Aug 12

Xvfb of SAP Business Objects Business Intelligence Platform, versions - 4.2, 4.3, platform on Unix does not perform any

CVE-2023-0022 HIGH
8.8 Jan 10

SAP BusinessObjects Business Intelligence Analysis edition for OLAP allows an authenticated attacker to inject malicious
CVE-2022-35228 HIGH
8.8 Jul 12

SAP BusinessObjects CMC allows an unauthenticated attacker to retrieve token information over the network which would ot
CVE-2019-0398 HIGH
8.8 Dec 11

Due to insufficient CSRF protection, SAP BusinessObjects Business Intelligence Platform (Monitoring Application), before
CVE-2025-0064 HIGH
8.7 Feb 11

Under specific conditions, the Central Management Console of the SAP BusinessObjects Business Intelligence platform allo

Same weakness CWE-502 – Deserialization of Untrusted Data

View all
CVE-2021-35464 CRITICAL POC
9.8
CVE-2020-10189 CRITICAL POC
9.8
CVE-2019-18935 CRITICAL POC
9.8
CVE-2015-7450 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8
CVE-2021-42237 CRITICAL POC
9.8
CVE-2025-24016 CRITICAL POC
9.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2020-6219 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy