CVE-2020-26831: sap businessobjects business intelligence pl…

csirt@kutim:~/threat-intel/cve/CVE-2020-26831

CVSS 9.6 · Critical EPSS 1,1%

Kerentanan pada sap businessobjects business intelligence platform. Skor CVSS 3.1 9.6 (Critical) menurut NVD.

Deskripsi (NVD)

SAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crystal report generation due to missing XML validation, An attacker with basic privileges can inject some arbitrary XML entities leading to internal file disclosure, internal directories disclosure, Server-Side Request Forgery (SSRF) and denial-of-service (DoS).

Rincian

Terbit di NVD: 9 Desember 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.6 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H · uraikan di kalkulator
EPSS (30 hari): 1,1% peluang dieksploitasi; lebih tinggi dari 64,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
sap	businessobjects business intelligence platform	Versi 4.1
sap	businessobjects business intelligence platform	Versi 4.2
sap	businessobjects business intelligence platform	Versi 4.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079 advisory vendor
https://launchpad.support.sap.com/#/notes/2989075 permissions required

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.