CVE-2020-6308: SAP BusinessObjects BI Platform Web Services unauthenticated SSRF

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated network-reachable SSRF with a very high EPSS score, though the CVSS impact is limited to low confidentiality and no KEV listing exists.

What it is

SAP BusinessObjects Business Intelligence Platform (Web Services) versions 410, 420 and 430 allow an unauthenticated attacker to inject arbitrary values as CMS parameters and trigger lookups against the internal network. Because the requests originate from the server, they reach internal services that are not externally accessible, turning the platform into an SSRF pivot.

Impact

An attacker can map internal infrastructure and gather information for follow-on attacks such as remote file inclusion, server file retrieval, firewall bypass, and forcing the server to issue malicious requests. The direct confidentiality impact is limited, but the internal reconnaissance value is significant.

Attack surface

Reachable over the network through the Web Services interface with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The attacker only needs to supply crafted CMS parameter values to the exposed service.

Exploitation

Not listed in CISA KEV and no public exploit or ransomware association is recorded in this entry, but EPSS is high at 0.617 (99th percentile), indicating elevated likelihood of exploitation activity. Reference tags are vendor advisory and permissions-required only, so no confirmed in-the-wild exploitation is documented here.

What to do

• Apply the SAP security note 2943844 fix for the affected BusinessObjects BI Platform versions (410, 420, 430) as the first action.
• Restrict outbound network access from the BI Web Services hosts so they cannot reach internal management, metadata, or file services.
• Place the Web Services endpoints behind authentication and network access controls, and avoid exposing them directly to untrusted networks.
• Validate and allowlist CMS parameter values where possible, rejecting arbitrary hostnames, URLs, and internal address ranges.
• Monitor SAP advisories for updated guidance and confirm the deployed build includes the patch.

Detection

• Monitor Web Services request logs for CMS parameters containing internal hostnames, IP addresses, or URL-like values.
• Alert on outbound connections from BI Platform servers to internal ranges or unexpected ports that are not part of normal operation.
• Correlate server-side requests to internal endpoints with the originating Web Services request to identify SSRF attempts.
• Review DNS and proxy logs for lookups of internal-only names originating from the BI Platform hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.