CVE-2023-41365

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-41365
SAP Business One (B1i) - version 10.0, allows an authorized attacker to retrieve the details stack trace of the fault message to conduct the XXE injection, which will lead to information disclosure. After successful exploitation, an attacker can cause limited impact on the confidentiality and no impact to the integrity and availability.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://me.sap.com/notes/3338380 Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html Vendor Advisory
https://me.sap.com/notes/3338380 Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:sap:business_one:10.0:*:*:*:*:*:*:*
History

21 Nov 2024, 08:21

Type Values Removed Values Added
References () https://me.sap.com/notes/3338380 - Permissions Required () https://me.sap.com/notes/3338380 - Permissions Required
References () https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory () https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory

26 Sep 2024, 19:15

Type Values Removed Values Added
CWE CWE-209 CWE-611
Summary (en) SAP Business One (B1i) - version 10.0, allows an authorized attacker to retrieve the details stack trace of the fault message to conduct the XXE injection, which will lead to information disclosure. After successful exploitation, an attacker can cause limited impact on the confidentiality and no impact to the integrity and availability. (en) SAP Business One (B1i) - version 10.0, allows an authorized attacker to retrieve the details stack trace of the fault message to conduct the XXE injection, which will lead to information disclosure. After successful exploitation, an attacker can cause limited impact on the confidentiality and no impact to the integrity and availability.

11 Oct 2023, 19:10

Type Values Removed Values Added
First Time Sap
Sap business One
References (MISC) https://me.sap.com/notes/3338380 - (MISC) https://me.sap.com/notes/3338380 - Permissions Required
References (MISC) https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - (MISC) https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.3
CPE cpe:2.3:a:sap:business_one:10.0:*:*:*:*:*:*:*

10 Oct 2023, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-10-10 02:15

Updated : 2024-11-21 08:21

NVD link : CVE-2023-41365

Mitre link : CVE-2023-41365

CVE.ORG link : CVE-2023-41365

JSON object : View

Products Affected

sap

  • business_one
CWE
CWE-611

Improper Restriction of XML External Entity Reference