CRITICAL🇵🇱 Wersja polska

CVE-2020-26831

CVSS 9.6v3.1pub. 2020-12-09upd. 2024-11-21

SAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crystal report generation due to missing XML validation, An attacker with basic privileges can inject some arbitrary XML entities leading to internal file disclosure, internal directories disclosure, Server-Side Request Forgery (SSRF) and denial-of-service (DoS).

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H

  • Sap Businessobjects Business Intelligence Platform

    APP
    Sap
    4.14.24.3
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SSRF
CWE
References

Related vulnerabilities

CVE-2023-0018CRITICAL10.0PL ✓same product

Stored XSS w SAP BusinessObjects BI Platform CMC — CVSS 10.0

CVE-2023-0022CRITICAL9.9PL ✓same product

SAP BusinessObjects BI — zdalne wykonanie kodu przez uwierzytelnionego użytkownika

CVE-2020-6294CRITICAL9.1PL ✓same product

SAP BusinessObjects BI Platform – brak uwierzytelnienia w komponencie Xvfb (Unix)

CVE-2020-6242CRITICAL9.8PL ✓same product

SAP BusinessObjects BI Platform — logowanie bez hasła do CMC (Missing Authentication)

CVE-2020-6195CRITICAL9.8PL ✓same product

SAP BusinessObjects BI Platform CMC ujawnia hasło w plaintext w odpowiedzi HTTP