Crystal Reports
Vendor:
First CVE: Aug 17, 2010 · Active for 15 years
7
Total CVEs
More Total CVEs than 85% of tracked products
1.4
Avg CVEs / Year
Higher CVE frequency than 59% of tracked products
8.5
Avg CVSS
Higher Avg CVSS than 77% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Crystal Reports over time
Volume of CVEsAvg CVSS Base Score
First CVE
Aug 17, 2010
15 years ago
Most Recent CVE
Mar 10, 2020
2,331 days ago
CVE Severity & Scoring
Crystal Reports7 CVEs
29%
57%
14%
All CVEs353,173 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local1 (14.3%)
Network2 (28.6%)
Unknown4 (57.1%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low3 (42.9%)
High0 (0.0%)
Unknown4 (57.1%)
User Interaction
None2 (28.6%)
Unknown4 (57.1%)
Required1 (14.3%)
Privileges Required
Low2 (28.6%)
High0 (0.0%)
None1 (14.3%)
Unknown4 (57.1%)
Top CVEs
Signals from CVEs in this product scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2010-2590HIGH Heap-based buffer overflow in the CrystalReports12.CrystalPrintControl.1 ActiveX control in PrintControl.dll 12.3.2.753 in SAP Crystal Reports 2008 SP3 Fix Pack 3.2 allows remote a | Dec 22, 2010 | 9.3 | 74 | NO | YES |
CVE-2019-0285CRITICAL The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive database information including credentials which can be misused by | Apr 10, 2019 | 9.8 | 45 | NO | YES |
CVE-2018-2427HIGH SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, and SAP Crystal Reports (version for Visual Studio .NET, Version 2010) allows an attacker to inject code th | Jul 10, 2018 | 8.8 | 27 | NO | NO |
CVE-2010-3032HIGH Integer overflow in the OBGIOPServerWorker::extractHeader function in the ebus-3-3-2-6.dll module in SAP Crystal Reports 2008 allows remote attackers to cause a denial of service ( | Aug 17, 2010 | 10.0 | 27 | NO | NO |
CVE-2014-5505MEDIUM Stack-based buffer overflow in SAP Crystal Reports allows remote attackers to execute arbitrary code via a crafted data source string in an RPT file. | Sep 4, 2014 | 6.8 | 23 | NO | NO |
CVE-2020-6208HIGH SAP Business Objects Business Intelligence Platform (Crystal Reports), versions- 4.1, 4.2, allows an attacker with basic authorization to inject code that can be executed by the ap | Mar 10, 2020 | 8.2 | 21 | NO | NO |
CVE-2014-5506MEDIUM Double free vulnerability in SAP Crystal Reports allows remote attackers to execute arbitrary code via crafted connection string record in an RPT file. | Sep 4, 2014 | 6.8 | 19 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (7 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
1 CVE
14.3% of CVEs· 98th percentile
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
2 CVEs
28.6% of CVEs· 88th percentile
Social Chatter
Signals from CVEs in this product scope (7 CVEs).
Media Mentions
Signals from CVEs in this product scope (7 CVEs).
Top CNAs Publishing CVEs For Crystal Reports
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 4.2 | 1 | 8.2 | 1.1% | 0 | 0 |
| 4.1 | 1 | 8.2 | 1.1% | 0 | 0 |
| 2010 | 1 | 9.8 | 6.6% | 0 | 1 |
| 2008 | 2 | 9.7 | 26.6% | 0 | 1 |