XXE in Sap Business One
CVE-2023-41365
SAP Business One (B1i) - version 10.0, allows an authorized attacker to retrieve the details stack trace of the fault message to conduct the XXE injection, which will lead to information disclosure. After successful exploitation, an attacker can cause limited impact on the confidentiality and no impact to the integrity and availability.
Vulnerability class: XXE (XML External Entity)
EPSS: 0.003 (24.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Sap Business_one — versions 10.0
- Sap_se Sap Business One (B1i) — versions 10.0
Weakness classification (CWE)
References
- cna@sap.com (Permissions Required)
- cna@sap.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-41365?
- CVE-2023-41365 is a medium-severity vulnerability in Sap Business One, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 4.3/10. Published 2023-10-10.
- How severe is CVE-2023-41365?
- Medium severity. CVSS v3 base score is 4.3 out of 10.