Critical severity · published Aug 12, 2020
CVE-2020-6294
Xvfb of SAP Business Objects Business Intelligence Platform, versions - 4.2, 4.3, platform on Unix does not perform any authentication checks for functionalities that require user…
9.1
CVSS
1.5%
EPSS
No
On KEV
Description
Xvfb of SAP Business Objects Business Intelligence Platform, versions - 4.2, 4.3, platform on Unix does not perform any authentication checks for functionalities that require user identity.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BB
Businessobjects Business Intelligence Platform · Sap
4.2; 4.3 · source: NVD
Affected product
BB
Businessobjects Business Intelligence Platform
Sap
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-6294
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-6294
Permissions Required
https://launchpad.support.sap.com/#/notes/2927956
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345
More from Businessobjects Business Intelligence Platform
9.8
CVE-2020-6242
SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on the Central Management Console without…
9.8
CVE-2020-6195
SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, leading to Information Disclosure
9.6
CVE-2020-26831
SAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crystal report generation due to missing…
9.3
CVE-2024-28165
SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to manipulate a parameter in the Opendocument URL which could lead to high…
9.1
CVE-2025-0061
SAP BusinessObjects Business Intelligence Platform allows an unauthenticated attacker to perform session hijacking over the network without any user interaction, due to an…