Lucene search

SapCVE-2020-6227

HistoryApr 14, 2020 - 7:15 p.m.

CVE-2020-6227

2020-04-1419:15:17

CWE-116

CWE-20

sap

web.nvd.nist.gov

sap

business objects

bi platform

cms

auditing

cve-2020-6227

security

vulnerability

glf log files

input validation

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

38.7%

JSON

SAP Business Objects Business Intelligence Platform (CMS / Auditing issues), version 4.2, allows attacker to send specially crafted GIOP packets to several services due to Improper Input Validation, allowing to forge additional entries in GLF log files.

Affected configurations

Nvd

Node

sapbusinessobjects_business_intelligence_platformMatch4.2-

VendorProductVersionCPE
sapbusinessobjects_business_intelligence_platform4.2cpe:2.3:a:sap:businessobjects_business_intelligence_platform:4.2:-:*:*:*:*:*:*

Vendor	Product	Version	CPE
sap	businessobjects_business_intelligence_platform	4.2	cpe:2.3:a:sap:businessobjects_business_intelligence_platform:4.2:-::::::

CNA Affected

[
  {
    "product": "SAP Business Objects Business Intelligence Platform (CMS / Auditing issues)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 4.2"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/2863396

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

38.7%

JSON

Related for CVE-2020-6227