Vulnerability record · CVE-2004-0204 · published 6 August 2004
CVE-2004-0204: Crystal Reports web viewer directory traversal via crystalimagehandler.aspx
Bea · Weblogic Server
The web viewers in Business Objects Crystal Reports 9 and 10 and Crystal Enterprise 9 and 10, as bundled with products such as Visual Studio .NET 2003, Outlook 2003 with Business Contact Manager, and Microsoft Business Solutions CRM 1.2, accept ".." sequences in the dynamicimag argument to crystalimagehandler.aspx. This directory traversal lets a remote attacker read and delete arbitrary files on the server. Because the affected viewers are embedded in widely deployed Microsoft and Business Objects products, the flaw exposes both report data and the underlying host filesystem.
Description
Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers to read and delete arbitrary files via ".." sequences in the dynamicimag argument to crystalimagehandler.aspx.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityUnauthenticated remote file read and delete with public exploit code and very high EPSS, though the affected products are legacy and no KEV listing exists.
What it is
The web viewers in Business Objects Crystal Reports 9 and 10 and Crystal Enterprise 9 and 10, as bundled with products such as Visual Studio .NET 2003, Outlook 2003 with Business Contact Manager, and Microsoft Business Solutions CRM 1.2, accept ".." sequences in the dynamicimag argument to crystalimagehandler.aspx. This directory traversal lets a remote attacker read and delete arbitrary files on the server. Because the affected viewers are embedded in widely deployed Microsoft and Business Objects products, the flaw exposes both report data and the underlying host filesystem.
Impact
An unauthenticated remote attacker can read arbitrary files, exposing configuration, credential and report data, and can delete arbitrary files, causing data loss or denial of service.
Attack surface
Reached over the network through HTTP requests to crystalimagehandler.aspx with a crafted dynamicimag parameter; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV, but EPSS is 0.72368 (99.4th percentile) and a SecurityFocus reference is tagged Exploit, indicating public exploit code exists.
What to do
- Apply the vendor fixes referenced in Microsoft security bulletin MS04-017 and the Business Objects security bulletin from June 2004.
- Upgrade or remove unsupported Crystal Reports 9/10 and Crystal Enterprise 9/10 web viewers that cannot be patched.
- Restrict network access to crystalimagehandler.aspx and the Crystal web viewer components to trusted clients only.
- Run the web viewer service with least privilege and on a host that does not hold sensitive files.
- Validate and normalize the dynamicimag parameter, rejecting any path containing ".." sequences.
Detection
- Inspect web server and proxy logs for requests to crystalimagehandler.aspx with dynamicimag values containing ".." or absolute paths.
- Alert on HTTP responses from the Crystal web viewer returning unexpected file content or unusual MIME types.
- Monitor filesystem audit logs for deletions or reads of files outside the Crystal web content directories by the web server process.
- Search for known exploit signatures or scanner traffic targeting crystalimagehandler.aspx.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
9 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2004-0204 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2004-0204), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
