« Back to list

CVE-2020-6242

Status: ModifiedCritical (9.8)—

SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on the Central Management Console without password in case of the BIPRWS application server was not protected with some specific certificate, leading to Missing Authentication Check.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

SAP — Businessobjects Business Intelligence Platform

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2020-6242",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAP Business Objects Business Intelligence Platform (Live Data Connect)",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.0"
            },
            {
              "status": "affected",
              "version": "< 2.0"
            },
            {
              "status": "affected",
              "version": "< 2.x"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-05-12T18:15:13.833",
  "references": [
    {
      "url": "https://launchpad.support.sap.com/#/notes/2885244",
      "tags": [
        "Permissions Required"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
      "tags": [
        "Broken Link",
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
      "tags": [
        "Broken Link",
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
      "tags": [
        "Broken Link",
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
      "tags": [
        "Broken Link",
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/2885244",
      "tags": [
        "Permissions Required"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
      "tags": [
        "Broken Link",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
      "tags": [
        "Broken Link",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
      "tags": [
        "Broken Link",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
      "tags": [
        "Broken Link",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on the Central Management Console without password in case of the BIPRWS application server was not protected with some specific certificate, leading to Missing Authentication Check."
    },
    {
      "lang": "es",
      "value": "SAP Business Objects Business Intelligence Platform (Live Data Connect), versiones 1.0, 2.0, 2.1, 2.2, 2.3, permite a un atacante entrar en la Central Management Console sin contraseña en caso de que el servidor de aplicaciones BIPRWS no estuviera protegido con algún certificado específico, conllevando a una Falta de Comprobación de Autenticación"
    }
  ],
  "lastModified": "2026-06-17T03:22:55.863",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:businessobjects_business_intelligence_platform:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "77EBF51D-452E-4CD9-8CC8-49A7847C8297"
            },
            {
              "criteria": "cpe:2.3:a:sap:businessobjects_business_intelligence_platform:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A388D485-0057-483E-AFE6-D390381C7022"
            },
            {
              "criteria": "cpe:2.3:a:sap:businessobjects_business_intelligence_platform:2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8177209E-C74F-4373-B9C6-FAB3903187E7"
            },
            {
              "criteria": "cpe:2.3:a:sap:businessobjects_business_intelligence_platform:2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E9F2B27B-7389-4A71-A9FF-075E2A98656C"
            },
            {
              "criteria": "cpe:2.3:a:sap:businessobjects_business_intelligence_platform:2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "15A06DA3-DD71-4ABD-AD59-B87DFF1868E7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}