PT-2023-4249 · Sap · Sap Business One

CVE-2023-37487 · Publicado 2023-08-08 · Atualizado 2024-09-28

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Business One (Service Layer) version 10.0

Description The issue is related to insufficient protection of service data in the SAP Business One system, which can be exploited by a remote attacker to disclose protected information. An authenticated attacker with deep knowledge can perform certain operations to access unintended data over the network, potentially leading to a high impact on confidentiality.

Recommendations For SAP Business One (Service Layer) version 10.0, consider restricting access to sensitive data and implementing additional security measures to prevent unauthorized access until a fix is available. As a temporary workaround, limit the ability of authenticated attackers to perform certain operations that could lead to data disclosure.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

CWE-497

Identificadores relacionados

BDU:2023-04564

CVE-2023-37487

Produtos afetados

Sap Business One

Referências · 7

• https://me.sap.com/notes/3333616 · Nota
• https://t.me/cibsecurity/67937 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-37487 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-37487 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-04564 · Nota de Segurança
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Aviso do Fabricante
• https://blogs.sap.com/2023/08/08/sap-security-patch-day-august-2023 · Nota