CVE-2020-6331: 
SAP 3D Visual Enterprise Viewer vulnerability analysis and mitigation

CVE-2020-6331 is a vulnerability in SAP 3D Visual Enterprise Viewer affecting the parsing of HPGL files within the hpgl plugin. The vulnerability was discovered and reported to the vendor on June 11, 2020, with a coordinated public release on September 10, 2020. The vulnerability received a CVSS v3.1 score of 7.0 (High), indicating significant potential impact (ZDI Advisory).

The vulnerability stems from improper validation of user-supplied data during the parsing of HPGL files within the hpgl plugin of SAP 3D Visual Enterprise Viewer. This flaw can result in a write operation occurring before the start of an allocated object. The vulnerability has been assigned a CVSS v3.1 base score of 7.0 with the vector string AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (ZDI Advisory).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process. The high severity rating indicates potential for significant impact on system confidentiality, integrity, and availability (ZDI Advisory).

The vulnerability requires user interaction to exploit, specifically requiring the target to visit a malicious page or open a malicious file. The attack complexity is considered high, though no authentication is required for exploitation (ZDI Advisory).

SAP has released an update to address this vulnerability. Users are advised to apply the security update as detailed in the SAP Security Advisory (ZDI Advisory).