What is CVE-2023-41369?

CVE-2023-41369 is a low-severity vulnerability in SAP S\/4 Hana, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 3.5/10. Published 2023-09-12.

How severe is CVE-2023-41369?

Low severity. CVSS v3 base score is 3.5 out of 10.

XXE in SAP S\/4 Hana

CVE-2023-41369

The Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, 107, 108, allows an attacker to upload the XML file as an attachment. When clicked on the XML file in the attachment section, the file gets opened in the browser to cause the entity loops to slow down the browser.

Vulnerability class: XXE (XML External Entity)

EPSS: 0.004 (33.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L.

Affected products

Sap S\/4_hana — versions 100, 101, 102
Sap_se Sap S/4hana (Create Single Payment Application) — versions 100, 101, 102

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

References

cna@sap.com (Permissions Required)
cna@sap.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-41369?: CVE-2023-41369 is a low-severity vulnerability in SAP S\/4 Hana, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 3.5/10. Published 2023-09-12.
How severe is CVE-2023-41369?: Low severity. CVSS v3 base score is 3.5 out of 10.