VYPR
← All advisories
Critical severity9.6NVD Advisory· Published Dec 9, 2020· Updated Jun 17, 2026

CVE-2020-26831

CVE-2020-26831

Description

SAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crystal report generation due to missing XML validation, An attacker with basic privileges can inject some arbitrary XML entities leading to internal file disclosure, internal directories disclosure, Server-Side Request Forgery (SSRF) and denial-of-service (DoS).

Affected products

5
  • SAP/BusinessObjects Platformllm-fuzzy
    Range: 4.1, 4.2, 4.3
  • SAP/Businessobjects Business Intelligence Platform3 versions
    cpe:2.3:a:sap:businessobjects_business_intelligence_platform:4.1:-:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:sap:businessobjects_business_intelligence_platform:4.1:-:*:*:*:*:*:*
    • cpe:2.3:a:sap:businessobjects_business_intelligence_platform:4.2:-:*:*:*:*:*:*
    • cpe:2.3:a:sap:businessobjects_business_intelligence_platform:4.3:*:*:*:*:*:*:*
  • SAP SE/SAP BusinessObjects BI Platform (Crystal Report)v5
    Range: < 4.1

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.