{"id":"CVE-2020-6245","aliases":["EUVD-2020-27395","GHSA-p6p8-j2vx-pqvh"],"status":"published","title":"SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access...","description":"SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code that can be executed by the application due to Improper Control of Resource Identifiers.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00335,"percentile":0.27027,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-74","CWE-99"],"published":"2020-05-12T17:49:07Z","modified":"2026-06-17T03:22:56Z","products":[{"vendor":"sap","product":"businessobjects_business_intelligence_platform"},{"vendor":"sap se","product":"sap business objects business intelligence platform"},{"vendor":"sap_se","product":"sap business objects business intelligence platform"}],"references":[{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://launchpad.support.sap.com/#/notes/2828558","tags":["x_refsource_MISC","x_transferred","Permissions Required"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-6245"},{"url":"https://github.com/advisories/GHSA-p6p8-j2vx-pqvh"}],"sources":{"cve":[{"id":"CVE-2020-6245","description":"SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code that can be executed by the application due to Improper Control of Resource Identifiers.","status":"published","published":"2020-05-12T17:49:07Z","modified":"2024-08-04T08:55:22.271Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-99"],"updated_at":"2026-11-02T14:35:52.268457Z"}],"euvd":[{"id":"EUVD-2020-27395","description":"SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code that can be executed by the application due to Improper Control of Resource Identifiers.","status":"published","published":"2020-05-12T17:49:07Z","modified":"2024-08-04T08:55:22Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-03T03:08:03.741202Z"}],"ghsa":[{"id":"GHSA-p6p8-j2vx-pqvh","title":"SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access...","description":"SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code that can be executed by the application due to Improper Control of Resource Identifiers.","status":"published","published":"2022-05-24T17:17:42Z","modified":"2023-01-29T05:02:36Z","updated_at":"2026-11-02T14:45:07.602262Z"}],"nvd":[{"id":"CVE-2020-6245","description":"SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code that can be executed by the application due to Improper Control of Resource Identifiers.","status":"published","published":"2020-05-12T18:15:14.053Z","modified":"2026-06-17T03:22:56.19Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"},{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-99","CWE-74"],"updated_at":"2026-11-02T14:06:00.784809Z"}]}}