CVE-2004-0204

CVE-2004-0204 describes a directory traversal vulnerability in Business Objects Crystal Reports web viewers (versions 9 and 10) and Crystal Enterprise (versions 9 and 10), impacting various products including Visual Studio .NET 2003 and Outlook 2003. This flaw allows unauthenticated remote attackers to read and delete arbitrary files by manipulating the "dynamicimag" argument in "crystalimagehandler.aspx" with ".." sequences. With a CVSS score of 7.5, this vulnerability is easily exploitable over the network with low attack complexity, leading to potential compromise of confidentiality, integrity, and availability. While not listed on CISA's KEV catalog, public exploit code exists on ExploitDB, indicating its exploitability. Despite its age and high FAUCET risk score, there is no evidence of active exploitation or significant community discussion.