Lucene search

SapCVE-2020-6195

HistoryApr 14, 2020 - 8:15 p.m.

CVE-2020-6195

2020-04-1420:15:15

CWE-522

CWE-319

sap

web.nvd.nist.gov

sap

business objects

business intelligence

cmc

version 4.1

version 4.2

cleartext password

information disclosure

social engineering

administrative rights

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.002

Percentile

61.3%

JSON

SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, leading to Information Disclosure. It involves social engineering in order to gain access to system and If password is known, it would give administrative rights to the attacker to read/modify delete the data and rights within the system.

Affected configurations

Nvd

Node

sapbusinessobjects_business_intelligence_platformMatch4.1-

sapbusinessobjects_business_intelligence_platformMatch4.2-

VendorProductVersionCPE
sapbusinessobjects_business_intelligence_platform4.1cpe:2.3:a:sap:businessobjects_business_intelligence_platform:4.1:-:*:*:*:*:*:*
sapbusinessobjects_business_intelligence_platform4.2cpe:2.3:a:sap:businessobjects_business_intelligence_platform:4.2:-:*:*:*:*:*:*

Vendor	Product	Version	CPE
sap	businessobjects_business_intelligence_platform	4.1	cpe:2.3:a:sap:businessobjects_business_intelligence_platform:4.1:-::::::
sap	businessobjects_business_intelligence_platform	4.2	cpe:2.3:a:sap:businessobjects_business_intelligence_platform:4.2:-::::::

CNA Affected

[
  {
    "product": "SAP Business Objects Business Intelligence Platform",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 4.1"
      },
      {
        "status": "affected",
        "version": "< 4.2"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/2878507

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.002

Percentile

61.3%

JSON

Related for CVE-2020-6195