CVE-2020-26831
Summary
| CVE | CVE-2020-26831 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-12-09 17:15:00 UTC |
| Updated | 2020-12-10 21:52:00 UTC |
| Description | SAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crystal report generation due to missing XML validation, An attacker with basic privileges can inject some arbitrary XML entities leading to internal file disclosure, internal directories disclosure, Server-Side Request Forgery (SSRF) and denial-of-service (DoS). |
Risk And Classification
Problem Types: NVD-CWE-Other
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Sap | Businessobjects Business Intelligence Platform | 4.1 | - | All | All |
| Application | Sap | Businessobjects Business Intelligence Platform | 4.2 | - | All | All |
| Application | Sap | Businessobjects Business Intelligence Platform | 4.3 | All | All | All |
| Application | Sap | Businessobjects Business Intelligence Platform | 4.1 | - | All | All |
| Application | Sap | Businessobjects Business Intelligence Platform | 4.2 | - | All | All |
| Application | Sap | Businessobjects Business Intelligence Platform | 4.3 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| launchpad.support.sap.com | MISC | launchpad.support.sap.com | Permissions Required |
| SAP Security Patch Day – December 2020 - Product Security Response at SAP - Community Wiki | MISC | wiki.scn.sap.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.