What is CVE-2023-31403?

CVE-2023-31403 is a critical-severity vulnerability in SAP Business One, classified under Incorrect Authorization. CVSS score: 9.6/10. Published 2023-11-14.

How severe is CVE-2023-31403?

Critical severity. CVSS v3 base score is 9.6 out of 10.

Auth bypass in SAP Business One

CVE-2023-31403

SAP Business One installation - version 10.0, does not perform proper authentication and authorization checks for SMB shared folder. As a result, any malicious user can read and write to the SMB shared folder. Additionally, the files in the folder can be executed or be used by the installation process leading to considerable impact on confidentiality, integrity and availability.

Vulnerability class: Broken Access Control

EPSS: 0.004 (35.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products

Sap Business_one — versions 10.0
Sap_se Sap Business One — versions 10.0

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

cna@sap.com (Permissions Required)
cna@sap.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-31403?: CVE-2023-31403 is a critical-severity vulnerability in SAP Business One, classified under Incorrect Authorization. CVSS score: 9.6/10. Published 2023-11-14.
How severe is CVE-2023-31403?: Critical severity. CVSS v3 base score is 9.6 out of 10.