TI-2020-05146 Aliases CVE-2020-6294 GHSA-f5jc-8383-8hp7

Missing authentication in SAP Business Objects Business Intelligence Platform

MEDIUM 42CWE-306Published 2020-08-12 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-306.

Summary

Xvfb of SAP Business Objects Business Intelligence Platform, versions - 4.2, 4.3, platform on Unix does not perform any authentication checks for functionalities that require user identity.

Why it matters now

EPSS 0.0153 74th percentileScored 2026-11-07

Fix Fixed SAP Business Objects Business Intelligence Platform (SAP SE): 4.2, 4.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP Business Objects Business Intelligence Platform	before 4.2; before 4.3	4.2, 4.3	Patch available	CNA

SAP Business Objects Business Intelligence Platform VendorSAP Affected before 4.2; before 4.3 Fixed in 4.2, 4.3 Patch available CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:businessobjects_business_intelligence_platform:4.2:-::::::	4.2	Vulnerable	SAP
cpe:2.3:a:sap:businessobjects_business_intelligence_platform:4.3:::::::*	4.3	Vulnerable	SAP
cpe:2.3:o:opengroup:unix:-:::::::*	not specified by NVD	Running on	Opengroup

cpe:2.3:a:sap:businessobjects_business_intelligence_platform:4.2:-:*:*:*:*:*:* Versions 4.2 Vulnerable ·SAP
cpe:2.3:a:sap:businessobjects_business_intelligence_platform:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·SAP
cpe:2.3:o:opengroup:unix:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Opengroup

Remediation

Fix · CNA SAP Business Objects Business Intelligence Platform (SAP SE) Fixed in 4.2, 4.3

Timeline

2026-10-02 Threatist record created from CVE-2020-6294
2026-10-03 Alias added: GHSA-f5jc-8383-8hp7

References

Advisory 1

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345

Other 1

https://launchpad.support.sap.com/#/notes/2927956

TI-2020-05160 Server-side request forgery in SAP BusinessObjects Business Intelligence Platform CVSS 3.1MEDIUM 5.3
TI-2023-00018 Cross-site scripting in SAP BusinessObjects Business Intelligence Platform CVSS 3.1CRITICAL 10.0
TI-2022-10999 When a user access SOAP Web services in SAP BusinessObjects Business Intelligence… CVSS 3.1HIGH 8.1
TI-2023-00022 Code Injection vulnerability in SAP BusinessObjects Business Intelligence platform (Analysis edition for OLAP) CVSS 3.1CRITICAL 9.9
TI-2020-05098 Missing authentication in SAP Business Objects Business Intelligence Platform CVSS 3.1CRITICAL 9.8
TI-2024-18743 Cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform CVSS 3.1CRITICAL 9.3

See all 72 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences