CVE-2020-6308

CVE-2020-6308 is a Server-Side Request Forgery (SSRF) vulnerability affecting SAP BusinessObjects Business Intelligence Platform (Web Services) versions 410, 420, and 430. An unauthenticated attacker can inject arbitrary values as CMS parameters to perform internal network lookups. This allows for internal network scanning, information gathering, and forcing the vulnerable server to make malicious requests, potentially leading to further attacks like remote file inclusion or firewall bypass. The vulnerability has a CVSS score of 5.3 (Medium), indicating a network-exploitable, low-complexity attack with no user interaction required, resulting in low confidentiality impact. While not listed on CISA's KEV catalog or the Hot List, Nuclei templates exist for blind SSRF, but there is no evidence of active exploitation, Metasploit modules, or ExploitDB entries, and community discussion and media coverage are minimal.