CVE-2020-26831
SAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crystal report generation due to missing XML validation, An attacker with basic privileges can inject some arbitrary…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.08%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
SAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crystal report generation due to missing XML validation, An attacker with basic privileges can inject some arbitrary XML entities leading to internal file disclosure, internal directories disclosure, Server-Side Request Forgery (SSRF) and denial-of-service (DoS).
- CVSS 3.1
- 9.6 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H
- EPSS
- 1.08% probability · 63th percentile
- CISA KEV
- Not listed
- Affected
- sap/businessobjects business intelligence platform
- Source
- cna@sap.com
References
- https://launchpad.support.sap.com/#/notes/2989075Permissions Required
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079Vendor Advisory
- https://launchpad.support.sap.com/#/notes/2989075Permissions Required
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.