CVE-2020-6350: 
SAP 3D Visual Enterprise Viewer vulnerability analysis and mitigation

CVE-2020-6350 affects SAP 3D Visual Enterprise Viewer version 9, discovered and disclosed in September 2020. The vulnerability allows attackers to manipulate BMP files that, when opened from untrusted sources, can cause the application to crash and become temporarily unavailable until restart (NVD Database).

The vulnerability stems from improper input validation when handling BMP files in SAP 3D Visual Enterprise Viewer. It has been assigned a CVSS v3.1 base score of 4.3 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L. The vulnerability is classified as an Out-of-bounds Write (CWE-787) issue (NVD Database, ZDI Advisory).

When exploited, the vulnerability results in the application becoming temporarily unavailable, requiring a restart to restore functionality. The impact is limited to availability, with no direct effects on confidentiality or integrity of the system (NVD Database).

The vulnerability requires user interaction to exploit, specifically opening a manipulated BMP file received from untrusted sources. The attack complexity is considered low, requiring no privileges but necessitating user interaction (ZDI Advisory).

SAP has released security updates to address this vulnerability. Users are advised to apply the available patches as detailed in the SAP Security Note (SAP Note).