What is CVE-2023-41365?

CVE-2023-41365 is a medium-severity vulnerability in SAP Business One, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 4.3/10. Published 2023-10-10.

How severe is CVE-2023-41365?

Medium severity. CVSS v3 base score is 4.3 out of 10.

XXE in SAP Business One

CVE-2023-41365

SAP Business One (B1i) - version 10.0, allows an authorized attacker to retrieve the details stack trace of the fault message to conduct the XXE injection, which will lead to information disclosure. After successful exploitation, an attacker can cause limited impact on the confidentiality and no impact to the integrity and availability.

Vulnerability class: XXE (XML External Entity)

Published 2023-10-10 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

EPSS exploit prediction

EPSS: 0.003 (22.6th percentile), scored 2026-10-04.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 23rd percentile — 22.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000

Affected products

SAP Business One — versions 10.0
SAP Se Business One (B1i) — versions 10.0

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

References

me.sap.com/notes/3338380 (Permissions Required)
www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html (Vendor Advisory)

Frequently asked questions

What is CVE-2023-41365?: CVE-2023-41365 is a medium-severity vulnerability in SAP Business One, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 4.3/10. Published 2023-10-10.
How severe is CVE-2023-41365?: Medium severity. CVSS v3 base score is 4.3 out of 10.