Vulnerability: CVE-2020-6208

SAP Business Objects Business Intelligence Platform (Crystal Reports), versions- 4.1, 4.2, allows an attacker with basic authorization to inject code that can be executed by the application and thus allowing the attacker to control the behaviour of the application, leading to Remote Code Execution. Although the mode of attack is only Local, multiple applications can be impacted as a result of the vulnerability.


https://launchpad.support.sap.com/#/notes/2861301
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305
https://www.zerodayinitiative.com/advisories/ZDI-20-291/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6208


It's possible to leave a comment as registered users to the site, accessing through social, wordpress account or as anonymous users. If you want to leave a comment as an anonymous user you will be notified by email of a possible response only if you enter the email address (optional). The insertion of any data in the comment fields is totally optional. Whoever decides to insert any data accepts the treatment of these last ones for the inherent purposes of the service that is the answer to the comment and the strictly necessary communications.


Leave a Reply