PT-2023-23298 · Sap · Sap Business One

CVE-2023-31403 · Publicado 2023-11-13 · Atualizado 2024-09-28

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Crítica

Vetor base

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Business One version 10.0

Description The SAP Business One installation does not perform proper authentication and authorization checks for SMB shared folders. This allows any malicious user to read and write to the SMB shared folder. Additionally, files in the folder can be executed or used by the installation process, leading to considerable impact on confidentiality, integrity, and availability.

Recommendations For SAP Business One version 10.0, consider restricting access to the SMB shared folder until a patch is available. As a temporary workaround, limit the execution of files from the shared folder to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2023-31403

Produtos afetados

Sap Business One

Referências · 9

• https://twitter.com/the_yellow_fall/status/1724447041261350975 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-31403 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-31403 · Aviso do Fabricante
• https://me.sap.com/notes/3355658 · Nota
• https://twitter.com/DefusedCyber/status/1724360100968571147 · Publicação no Twitter
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Aviso do Fabricante
• https://t.me/cvenotify/60813 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1724246601764348332 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1724323653645443438 · Publicação no Twitter