CVE-2020-6308
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
3Exploited in Wild
-Decision
Descriptions
SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure and gather information for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to perform malicious requests, resulting in a Server-Side Request Forgery vulnerability.
SAP BusinessObjects Business Intelligence Platform (Web Services) versiones 410, 420, 430, permiten a un atacante no autenticado inyectar valores arbitrarios como parámetros de CMS para realizar búsquedas en la red interna que de otro modo no sería accesible externamente. En una explotación exitosa, el atacante puede escanear la red interna para determinar la infraestructura interna y recopilar información para futuros ataques como la inclusión de archivos remotos, recuperar archivos del servidor, omitir el firewall y forzar al servidor vulnerable a llevar a cabo peticiones maliciosas, resultando en una vulnerabilidad de tipo Server-Side Request Forgery
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-01-08 CVE Reserved
- 2020-10-20 CVE Published
- 2020-11-24 First Exploit
- 2024-03-25 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-918: Server-Side Request Forgery (SSRF)
CAPEC
References (4)
URL | Tag | Source |
---|
URL | Date | SRC |
---|---|---|
https://github.com/InitRoot/CVE-2020-6308-PoC | 2020-12-29 | |
https://github.com/TheMMMdev/CVE-2020-6308 | 2021-08-24 | |
https://github.com/freeFV/CVE-2020-6308-mass-exploiter | 2020-11-24 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196 | 2020-10-22 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Sap Search vendor "Sap" | Businessobjects Business Intelligence Platform Search vendor "Sap" for product "Businessobjects Business Intelligence Platform" | 4.1 Search vendor "Sap" for product "Businessobjects Business Intelligence Platform" and version "4.1" | - |
Affected
| ||||||
Sap Search vendor "Sap" | Businessobjects Business Intelligence Platform Search vendor "Sap" for product "Businessobjects Business Intelligence Platform" | 4.2 Search vendor "Sap" for product "Businessobjects Business Intelligence Platform" and version "4.2" | - |
Affected
| ||||||
Sap Search vendor "Sap" | Businessobjects Business Intelligence Platform Search vendor "Sap" for product "Businessobjects Business Intelligence Platform" | 4.3 Search vendor "Sap" for product "Businessobjects Business Intelligence Platform" and version "4.3" | - |
Affected
|