CVE-2020-6288
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface) allows an attacker with edit document rights to upload any file (including script files) without proper file format validation leading to Unrestricted upload of file with dangerous type vulnerability. The attacker can modify some formulas and display erroneous content. The server is not affected only the current user browser session, that can easily be closed.
SAP Business Objects Business Intelligence Platform (interfaz Web Intelligence HTML) permite a un atacante con derechos de edición de documentos cargar cualquier archivo (incluyendo los archivos de script) sin la comprobación apropiada del formato de archivo, conllevando a una carga Sin Restricciones de archivo con una vulnerabilidad con tipo peligroso. El atacante puede modificar algunas fórmulas y mostrar contenido erróneo. El servidor no está afectado solo por la sesión actual del navegador del usuario, que puede fácilmente ser cerrado.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-01-08 CVE Reserved
- 2020-09-09 CVE Published
- 2023-04-16 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-434: Unrestricted Upload of File with Dangerous Type
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700 | 2020-09-10 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Sap Search vendor "Sap" | Businessobjects Business Intelligence Platform Search vendor "Sap" for product "Businessobjects Business Intelligence Platform" | 4.1 Search vendor "Sap" for product "Businessobjects Business Intelligence Platform" and version "4.1" | - |
Affected
| ||||||
Sap Search vendor "Sap" | Businessobjects Business Intelligence Platform Search vendor "Sap" for product "Businessobjects Business Intelligence Platform" | 4.2 Search vendor "Sap" for product "Businessobjects Business Intelligence Platform" and version "4.2" | - |
Affected
|