CVE-2020-6325 Multiple Vulnerabilities in SAP BusinessObjects Business Intelligence Platform, SAP security note 2930128

SAP security note 2930128, "[CVE-2020-6325] Multiple Vulnerabilities in SAP BusinessObjects Business Intelligence Platform". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This SAP Security Note addresses several vulnerabilities identified in SAP BusinessObjects Business Intelligence Platform.

• Reflected Cross-Site Scripting (XSS) Vulnerability (CVE-2020-6325, CVSS 5.4): potential theft of user authentication information and user impersonation; integrity impact includes non-permanent defacing or modification of displayed content.
• Stored Cross-Site Scripting (XSS) Vulnerability (CVE-2020-6312, CVSS 5.4): unauthorized access or modification of metadata for certain web page elements through malicious scripts.
• Unrestricted File Upload Vulnerability (CVE-2020-6288, CVSS 4.6): allows attackers to upload malicious files, potentially leading to data access or display of erroneous content in the victim user’s browser.

Solution

• Reflected XSS: implemented output encoding techniques to prevent XSS.
• Stored XSS: encoded user inputs for the affected workflows.
• Unrestricted File Upload: properly validated MIME types to prevent successful attacks.

Reason and prerequisites

• Cross-Site Scripting: several parameters within the application were not properly encoded.
• Unrestricted File Upload: MIME types of uploaded files were not correctly validated.

Affected components

• Business intelligence solutions > Business intelligence platform > BI Workspaces (Dashboard Builder)
• ENTERPRISE: Versions 410 to 420