PT-2022-4084 · Sap · Sap Business One

Published 2022-07-04 · Updated 2022-07-20 · CVE-2022-35168

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SAP Business One version 10.0

Description The issue is related to improper input sanitization of XML input, which can lead to a denial-of-service attack, rendering the system temporarily inoperative. This can be exploited by an attacker to cause a disruption in service. The vulnerability is also associated with errors in XML external entity (XXE) references, allowing a remote attacker to cause a denial of service.

Recommendations For SAP Business One version 10.0, update the system to a version that includes proper input sanitization of XML input to prevent denial-of-service attacks. As a temporary workaround, consider restricting XML input to trusted sources until a patch is available.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2022-04918

CVE-2022-35168

Affected Products

Sap Business One

References · 7

• https://launchpad.support.sap.com/#/notes/3211203 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35168 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35168 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04918 · Security Note
• https://t.me/cibsecurity/46091 · Telegram Post
• https://vuldb.com/ru/?id.203769 · Note