← Vulnerability feed

Vulnerability record · CVE-2020-6242 · published 12 May 2020

CVE-2020-6242: Sap businessobjects business intelligence platform missing authentication for critical function vulnerability

Sap · Businessobjects Business Intelligence Platform

SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on the Central Management Console without password in case of the BIPRWS application server was not protected with some specific certificate, leading to Missing Authentication Check.

9.8 CVSS 3.1 Critical EPSS 0.84% · top 43.7% CWE-306 · Missing authentication for critical function
9.8CVSS 3.1 base score, v2 7.5
0.84%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
10References
17 Jun 2026Last modified by NVD

Description

SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on the Central Management Console without password in case of the BIPRWS application server was not protected with some specific certificate, leading to Missing Authentication Check.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://launchpad.support.sap.com/#/notes/2885244 Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 Broken LinkVendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 Broken LinkVendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 Broken LinkVendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 Broken LinkVendor Advisory
https://launchpad.support.sap.com/#/notes/2885244 Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 Broken LinkVendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 Broken LinkVendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 Broken LinkVendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 Broken LinkVendor Advisory

Track CVE-2020-6242 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-6195Sap businessobjects business intelligence platform cleartext transmission vulnerabilitySAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, leading to Information Disclos…EPSS 0.63%9.6CVE-2020-26831Sap businessobjects business intelligence platform vulnerabilitySAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crystal repor…EPSS 1.1%9.3CVE-2024-28165Sap businessobjects business intelligence platform cross-site scripting vulnerabilitySAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to manipulate a parameter in the Opendocument UR…EPSS 0.57%9.1CVE-2025-0061Sap businessobjects business intelligence platform vulnerabilitySAP BusinessObjects Business Intelligence Platform allows an unauthenticated attacker to perform session hijacking over the network without any user …EPSS 0.51%9.1CVE-2023-24530Sap businessobjects business intelligence platform unrestricted file upload vulnerabilitySAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an authenticated admin user to upload malicious code that can be…EPSS 0.56%9.1CVE-2020-6294Sap businessobjects business intelligence platform missing authentication for critical function vulnerabilityXvfb of SAP Business Objects Business Intelligence Platform, versions - 4.2, 4.3, platform on Unix does not perform any authentication checks for fun…EPSS 1.5%8.8CVE-2023-0022Sap businessobjects business intelligence platform code injection vulnerabilitySAP BusinessObjects Business Intelligence Analysis edition for OLAP allows an authenticated attacker to inject malicious code that can be executed by…EPSS 0.74%8.8CVE-2022-35228Sap businessobjects business intelligence platform cross-site request forgery vulnerabilitySAP BusinessObjects CMC allows an unauthenticated attacker to retrieve token information over the network which would otherwise be restricted. This c…EPSS 0.55%

Source: NIST National Vulnerability Database (record CVE-2020-6242), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.