CVE-2010-3982: SAP BusinessObjects Enterprise XI 3.2 allows remote attackers to trigger TCP connections to arbitrary intra...

Security readout for executives and security teams

This flaw could let a remote user make a SAP BusinessObjects server probe internal systems and learn which ports respond. The source data names SAP BusinessObjects Enterprise XI 3.2 and the CrystalReports/viewrpt.cwr endpoint. It is mainly an internal reconnaissance and information-disclosure risk, not evidence of direct takeover. Exposure is most likely where SAP BusinessObjects Enterprise XI 3.2, especially Crystal Reports viewing paths, is reachable by untrusted users or the internet and can initiate outbound connections to internal networks. Prioritize this if legacy BusinessObjects is internet-facing or has broad internal network reach. The business risk is attacker-led internal mapping that can support later compromise. If isolated and access-controlled, urgency is lower but still warrants review because the product version is old. Mitigation focus: Check SAP guidance for XI 3.2 fixes, workarounds, or upgrade paths.; Restrict untrusted access to CrystalReports/viewrpt.cwr and BusinessObjects web paths.; Limit server outbound access to only required internal destinations and ports..

Prepared

Jun 28, 2026, 01:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.