CVE-2019-0285 Information disclosure in SAP Crystal Reports for Visual Studio

What is CVE-2019-0285?

CVE-2019-0285 is a critical vulnerability in SAP Crystal Reports for Visual Studio, published on 10 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive database information including credentials which can be misused by the attacker.

Weakness: CWE-312

Which versions are affected by CVE-2019-0285?

It affects 1 product.

Products include Sap Crystal Reports.

How do I fix CVE-2019-0285?

No fix has been published for CVE-2019-0285 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-0285 being exploited?

There is no known exploitation of CVE-2019-0285 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in SAP Crystal Reports for Visual Studio

• CVE-2010-3032 Integer overflow in n/a Critical 10.0
• CVE-2010-2590 Memory corruption in n/a Critical 9.3
• CVE-2020-6208 Use after free in SAP Business Objects Business Intelligence Platform (Crystal Reports) High 7.5
• CVE-2014-5505 Memory corruption in n/a Medium 6.8
• CVE-2014-5506 Use after free in n/a Medium 6.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-q65c-v485-vhfq.