CVE-2020-6288: Malicious File Upload

Published Sep 9, 2020

Updated

SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface) allows an attacker with edit document rights to upload any file (including script files) without proper file format validation leading to Unrestricted upload of file with dangerous type vulnerability. The attacker can modify some formulas and display erroneous content. The server is not affected only the current user browser session, that can easily be closed.

Affected Software

2 affected components

SAP BusinessObjects Business Intelligence platform=4.1

SAP BusinessObjects Business Intelligence platform=4.2

Event History

Sep 9, 2020

CVE Published

via MITRE·12:52 PM

Data Sourced

via MITRE·12:52 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID of this security issue?

The vulnerability ID is CVE-2020-6288.

What is the title of this vulnerability?

The title of this vulnerability is 'SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface) allows an atta…'

What is the severity rating of CVE-2020-6288?

The severity rating of CVE-2020-6288 is medium with a value of 5.3.

Which software is affected by this vulnerability?

The SAP Business Objects Business Intelligence Platform versions 4.1 and 4.2 are affected.

How can I fix the CVE-2020-6288 vulnerability?

To fix the CVE-2020-6288 vulnerability, you should apply the necessary security patches provided by SAP.