PT-2023-23298 · Sap · Sap Business One

Published 2023-11-13 · Updated 2024-09-28 · CVE-2023-31403

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Business One version 10.0

Description The SAP Business One installation does not perform proper authentication and authorization checks for SMB shared folders. This allows any malicious user to read and write to the SMB shared folder. Additionally, files in the folder can be executed or used by the installation process, leading to considerable impact on confidentiality, integrity, and availability.

Recommendations For SAP Business One version 10.0, consider restricting access to the SMB shared folder until a patch is available. As a temporary workaround, limit the execution of files from the shared folder to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2023-31403

Affected Products

Sap Business One

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-31403 · Security Note
• https://osv.dev/vulnerability/CVE-2023-31403 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://twitter.com/the_yellow_fall/status/1724447041261350975 · Twitter Post
• https://me.sap.com/notes/3355658 · Note
• https://twitter.com/DefusedCyber/status/1724360100968571147 · Twitter Post
• https://t.me/cvenotify/60813 · Telegram Post
• https://twitter.com/CVEnew/status/1724246601764348332 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1724323653645443438 · Twitter Post