CVE-2020-26831
- State
- Published
- Severity
- 9.6 Critical
- Published
- Dec 9, 2020
- Updated
- Aug 4, 2024
- Reserved
- Oct 7, 2020
Description
SAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crystal report generation due to missing XML validation, An attacker with basic privileges can inject some arbitrary XML entities leading to internal file disclosure, internal directories disclosure, Server-Side Request Forgery (SSRF) and denial-of-service (DoS).
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 9.6 Critical | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H | sap |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
SAP BusinessObjects BI Platform (Crystal Report)SAP SE |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.