Back to CVE Browser

CVE-2020-6195

CRITICAL

9.8

CVSS Severity Score

EPSS Score0.0540%

EPSS Percentile37.42th

PublishedApr 14, 2020

Last ModifiedNov 21, 2024

Vulnerability Description

SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, leading to Information Disclosure. It involves social engineering in order to gain access to system and If password is known, it would give administrative rights to the attacker to read/modify delete the data and rights within the system.

Affected Platforms (CPE)

📦

Sap

Businessobjects Business Intelligence Platform

= 4.1

📦

Sap

Businessobjects Business Intelligence Platform

= 4.2

References & Advisories

🔗 https://launchpad.support.sap.com/#/notes/2878507

🔗 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202

🔗 https://launchpad.support.sap.com/#/notes/2878507

🔗 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202

Related Vulnerabilities

CVE-2019-03988.8

Due to insufficient CSRF protection, SAP BusinessObjects Business Intelligence Platform (Monitoring Application), before versions ...

CVE-2019-02688.1

SAP BusinessObjects Business Intelligence Platform (CMC Module), versions 4.10, 4.20 and 4.30, does not sufficiently validate an X...

CVE-2019-02877.6

Under certain conditions SAP BusinessObjects Business Intelligence platform (Central Management Server), versions 4.2 and 4.3, all...

CVE-2021-405007.5

SAP BusinessObjects Business Intelligence Platform (Crystal Reports) - versions 420, 430, allows an unauthenticated attacker to ex...