{"api_version":"1","generated_at":"2026-07-23T14:36:44+00:00","cve":"CVE-2020-6245","urls":{"html":"https://cve.report/CVE-2020-6245","api":"https://cve.report/api/cve/CVE-2020-6245.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-6245","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-6245"},"summary":{"title":"CVE-2020-6245","description":"SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code that can be executed by the application due to Improper Control of Resource Identifiers.","state":"PUBLIC","assigner":"cna@sap.com","published_at":"2020-05-12 18:15:00","updated_at":"2020-05-14 19:03:00"},"problem_types":["CWE-74"],"metrics":[],"references":[{"url":"https://launchpad.support.sap.com/#/notes/2828558","name":"https://launchpad.support.sap.com/#/notes/2828558","refsource":"MISC","tags":["Permissions Required"],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222","name":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222","refsource":"MISC","tags":["Vendor Advisory"],"title":"SAP Security Patch Day – May 2020 - Product Security Response at SAP - Community Wiki","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-6245","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-6245","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"6245","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"businessobjects_business_intelligence_platform","cpe6":"4.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"6245","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"businessobjects_business_intelligence_platform","cpe6":"4.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2020-6245","ASSIGNER":"cna@sap.com","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"SAP SE","product":{"product_data":[{"product_name":"SAP Business Objects Business Intelligence Platform","version":{"version_data":[{"version_name":"<","version_value":"4.2"}]}}]}}]}},"description":{"description_data":[{"lang":"eng","value":"SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code that can be executed by the application due to Improper Control of Resource Identifiers."}]},"impact":{"cvss":{"baseScore":"6.5","vectorString":"CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.0"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-99"}]}]},"references":{"reference_data":[{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222","refsource":"MISC","name":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222"},{"url":"https://launchpad.support.sap.com/#/notes/2828558","refsource":"MISC","name":"https://launchpad.support.sap.com/#/notes/2828558"}]}},"nvd":{"publishedDate":"2020-05-12 18:15:00","lastModifiedDate":"2020-05-14 19:03:00","problem_types":["CWE-74"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM"},"exploitabilityScore":0.8,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:P/I:P/A:P","accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":4.6},"severity":"MEDIUM","exploitabilityScore":3.9,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sap:businessobjects_business_intelligence_platform:4.2:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"6245","Ordinal":"166498","Title":"CVE-2020-6245","CVE":"CVE-2020-6245","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"6245","Ordinal":"1","NoteData":"SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code that can be executed by the application due to Improper Control of Resource Identifiers.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"6245","Ordinal":"2","NoteData":"2020-05-12","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"6245","Ordinal":"3","NoteData":"2020-05-12","Type":"Other","Title":"Modified"}]}}}