CVE-2020-6242 — Missing Authentication for Critical Function in SE SAP Business Objects Business Intelligence Platform

CWE-306 — Missing Authentication for Critical Function3 documents3 sources
Severity
9.8CRITICALNVD
EPSS
0.2%
top 54.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
SAP SE SAP Business Objects Business Intelligence PlatformSAP Businessobjects Business Intelligence Platform
Timeline
PublishedMay 12
Latest updateMay 24

Description

SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on the Central Management Console without password in case of the BIPRWS application server was not protected with some specific certificate, leading to Missing Authentication Check.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-pqh4-8hg2-8vjp: SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1↗2022-05-24
▶
CVEList
CVE-2020-6242: SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1↗2020-05-12
▶
CVE-2020-6242 — CRITICAL severity | cvebase