TI-2020-05064 Aliases CVE-2020-6208 GHSA-j37h-pxr7-r959

Use after free in SAP Business Objects Business Intelligence Platform

LOW 38CWE-416Published 2020-03-10 · Updated 2024-08-04

Key facts

Attack vector: Local
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

SAP Business Objects Business Intelligence Platform (Crystal Reports), versions- 4.1, 4.2, allows an attacker with basic authorization to inject code that can be executed by the application and thus allowing the attacker to control the behaviour of the application, leading to Remote Code Execution. Although the mode of attack is only Local, multiple applications can be impacted as a result of the vulnerability.

Why it matters now

EPSS 0.01142 66th percentileScored 2026-11-07

Fix Fixed SAP Business Objects Business Intelligence Platform (Crystal Reports) (SAP SE): 4.1, 4.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP Business Objects Business Intelligence Platform (Crystal Reports)	before 4.1; before 4.2	4.1, 4.2	Patch available	CNA

SAP Business Objects Business Intelligence Platform (Crystal Reports) VendorSAP Affected before 4.1; before 4.2 Fixed in 4.1, 4.2 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:crystal_reports:4.1:::::::*	4.1	Vulnerable	SAP
cpe:2.3:a:sap:crystal_reports:4.2:::::::*	4.2	Vulnerable	SAP

cpe:2.3:a:sap:crystal_reports:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·SAP
cpe:2.3:a:sap:crystal_reports:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·SAP

Remediation

Fix · CNA SAP Business Objects Business Intelligence Platform (Crystal Reports) (SAP SE) Fixed in 4.1, 4.2

Timeline

2026-10-02 Threatist record created from CVE-2020-6208
2026-10-03 Alias added: GHSA-j37h-pxr7-r959

References

Advisory 2

Other 1

https://launchpad.support.sap.com/#/notes/2861301

TI-2010-02487 Heap-based buffer overflow in the CrystalReports12.CrystalPrintControl.1 ActiveX control… CVSS 2.0HIGH 9.3
TI-2019-00246 Cleartext storage of sensitive information in SAP Crystal Reports for Visual Studio CVSS 3.0CRITICAL 9.8
TI-2010-02902 Integer overflow in the OBGIOPServerWorker::extractHeader function in the… CVSS 2.0HIGH 10.0
TI-2018-01811 Code injection in SAP BusinessObjects Business Intelligence Suite CVSS 3.0HIGH 8.8
TI-2014-04473 Stack-based buffer overflow in SAP Crystal Reports allows remote attackers to execute… CVSS 2.0MEDIUM 6.8
TI-2014-04474 Double free vulnerability in SAP Crystal Reports allows remote attackers to execute… CVSS 2.0MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences