CVE-2020-26831
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
SAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crystal report generation due to missing XML validation, An attacker with basic privileges can inject some arbitrary XML entities leading to internal file disclosure, internal directories disclosure, Server-Side Request Forgery (SSRF) and denial-of-service (DoS).
SAP BusinessObjects BI Platform (Crystal Report), versiones - 4.1, 4.2, 4.3, no comprueba suficientemente las entidades XML cargadas durante la generación del reporte crystal debido a una falta de comprobación XML. Un atacante con privilegios básicos puede inyectar algunas entidades XML arbitrarias conllevando a una divulgación interna de archivos, una divulgación de directorios internos, un Server-Side Request Forgery (SSRF) y denegación de servicio (DoS)
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-10-07 CVE Reserved
- 2020-12-09 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079 | 2020-12-10 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Sap Search vendor "Sap" | Businessobjects Business Intelligence Platform Search vendor "Sap" for product "Businessobjects Business Intelligence Platform" | 4.1 Search vendor "Sap" for product "Businessobjects Business Intelligence Platform" and version "4.1" | - |
Affected
| ||||||
Sap Search vendor "Sap" | Businessobjects Business Intelligence Platform Search vendor "Sap" for product "Businessobjects Business Intelligence Platform" | 4.2 Search vendor "Sap" for product "Businessobjects Business Intelligence Platform" and version "4.2" | - |
Affected
| ||||||
Sap Search vendor "Sap" | Businessobjects Business Intelligence Platform Search vendor "Sap" for product "Businessobjects Business Intelligence Platform" | 4.3 Search vendor "Sap" for product "Businessobjects Business Intelligence Platform" and version "4.3" | - |
Affected
|