Lucene search

SapCVELIST:CVE-2020-6195

HistoryApr 14, 2020 - 7:36 p.m.

CVE-2020-6195

2020-04-1419:36:32

sap

www.cve.org

CVSS3

6.4

Attack Vector

PHYSICAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.002

Percentile

61.3%

JSON

SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, leading to Information Disclosure. It involves social engineering in order to gain access to system and If password is known, it would give administrative rights to the attacker to read/modify delete the data and rights within the system.

CNA Affected

[
  {
    "product": "SAP Business Objects Business Intelligence Platform",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 4.1"
      },
      {
        "status": "affected",
        "version": "< 4.2"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/2878507

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202

CVSS3

6.4

Attack Vector

PHYSICAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.002

Percentile

61.3%

JSON

Related for CVELIST:CVE-2020-6195