CVE-2020-6219: SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Reports for VS version 2010, allows an…

PriorityP352high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

1.27%

66.4th percentile

SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Reports for VS version 2010, allows an attacker with basic authorization to perform deserialization attack in the application, leading to service interruptions and denial of service and unauthorized execution of arbitrary commands, leading to Deserialization of Untrusted Data.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
sap	businessobjects_business_intelligence_platform	—	—
sap	businessobjects_business_intelligence_platform	—	—
sap	crystal_reports_for_visual_studio	—	—
sap_se	crystal_reports_for_vs	< 2010	2010
sap_se	sap_business_objects_business_intelligence_platform	< 4.1	4.1
sap_se	sap_business_objects_business_intelligence_platform	< 4.2	4.2

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv3.09.1CRITICALCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H

nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.