CVE-2020-6242

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on the Central Management Console without password in case of the BIPRWS application server was not protected with some specific certificate, leading to Missing Authentication Check.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
SAP SE	SAP Business Objects Business Intelligence Platform (Live Data Connect)	< 1.0; < 2.0; < 2.x

References

https://launchpad.support.sap.com/#/notes/2885244Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222Broken Link, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222Broken Link, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222Broken Link, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222Broken Link, Vendor Advisory
https://launchpad.support.sap.com/#/notes/2885244Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222Broken Link, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222Broken Link, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222Broken Link, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222Broken Link, Vendor Advisory

Timeline

Published: May 12, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-62438.8Under certain conditions, SAP Adaptive Server Enterprise (XP Server on Windows Platform), versions 15.7, 16.0, does not perform the necessar CVE-2020-62447.8SAP Business Client, version 7.0, allows an attacker after a successful social engineering attack to inject malicious code as a DLL file in CVE-2020-62456.7SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code t CVE-2020-62466.1SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_TABLE, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, CVE-2020-62477.5SAP Business Objects Business Intelligence Platform, version 4.2, allows an unauthenticated attacker to prevent legitimate users from access CVE-2020-62487.2SAP Adaptive Server Enterprise (Backup Server), version 16.0, does not perform the necessary validation checks for an authenticated user whi CVE-2020-62498.8The use of an admin backend report within SAP Master Data Governance, versions - S4CORE 101, S4FND 102, 103, 104, SAP_BS_FND 748; allows an CVE-2020-62506.8SAP Adaptive Server Enterprise, version 16.0, allows an authenticated attacker to exploit certain misconfigured endpoints exposed over the a CVE-2020-62516.5Under certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access i CVE-2020-62528.0Under certain conditions SAP Adaptive Server Enterprise (Cockpit), version 16.0, allows an attacker with access to local network, to get sen CVE-2020-62537.2Under certain conditions, SAP Adaptive Server Enterprise (Web Services), versions 15.7, 16.0, allows an authenticated user to execute crafte CVE-2020-62546.1SAP Enterprise Threat Detection, versions 1.0, 2.0, does not sufficiently encode error response pages in case of errors, allowing XSS payloa