Vulnetix
Try Vulnetix Request Demo
CVE-2020-26831 PUBLISHED CVSS 9.600000381469727 CRITICAL

SAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crystal report generation due to missing XML validation, An attacker with basic privileges can inject some arbitrary XML entities leading to internal file disclosure, internal directories disclosure, Server-Side Request Forgery (SSRF) and denial-of-service (DoS).

EPSS 0.61% · 69.7th percentile

Risk Scores

CVSS v3.0
9.600000381469727
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H
EPSS Score
0.61%
69.7th percentile

Affected Products

VendorProductVersions
SAP SESAP BusinessObjects BI Platform (Crystal Report)< 4.1, < 4.2, < 4.3
sapbusinessobjects_business_intelligence_platform4.1, 4.2, 4.3

Timeline

References

Open in Interactive Console →