CVE-2004-0204: Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Cry...

Security readout for executives and security teams

This flaw lets a remote user abuse old Crystal Reports web viewers to reach outside the intended image path. The reported impact is serious: arbitrary file reading and deletion on affected systems. It mainly matters where legacy Crystal Reports or bundled Microsoft products still expose the vulnerable ASP.NET viewer. Exposure is most likely in legacy internet or intranet applications using Crystal Reports web viewers, including deployments bundled with Visual Studio .NET 2003, Outlook 2003 Business Contact Manager, Microsoft Business Solutions CRM 1.2, and related products. Treat this as high priority if legacy Crystal Reports viewers remain reachable. The business risk is unauthorized file disclosure or deletion on systems that may host reports, customer data, or application configuration. Mitigation focus: Inventory Crystal Reports 9/10 and Crystal Enterprise 9/10 web viewer deployments.; Apply Business Objects June 2004 critical bulletin fixes where applicable.; Apply Microsoft MS04-017 updates for affected Microsoft-bundled components..

Prepared

Jun 30, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.