by Kastro
Paper/Archive/CVE-2023-31403

CVE-2023-31403

SAP_SE SAP Business One — Improper Access Control vulnerability in SAP Business One product installation

EPSS 0.4%CVSS 9.6
critical.is priorityof 100
36
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 37.9.379 × 207.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SAP Business One installation - version 10.0, does not perform proper authentication and authorization checks for SMB shared folder. As a result, any malicious user can read and write to the SMB shared folder. Additionally, the files in the folder can be executed or be used by the installation process leading to considerable impact on confidentiality, integrity and availability.

Affected

ProductAffectedFixed inSource
SAP Business One10.0–CNA

Scores by source

sap (CNA)9.6CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refme.sap.com/notes/3355658refsap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html