PT-2023-27932 · Sap · Sap S/4Hana

Published 2023-09-11 · Updated 2023-09-14 · CVE-2023-41369

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions SAP S/4HANA versions 100 through 108

Description The issue allows an attacker to upload an XML file as an attachment in the Create Single Payment application. When the XML file is clicked on in the attachment section, it opens in the browser and can cause entity loops, slowing down the browser.

Recommendations For SAP S/4HANA versions 100 through 108, consider restricting the upload of XML files in the Create Single Payment application to prevent potential exploitation. As a temporary workaround, avoid clicking on XML files in the attachment section to minimize the risk of browser slowdown.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2023-41369

PYSEC-2023-172

Affected Products

Sap S/4Hana

References · 6

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41369 · Security Note
• https://osv.dev/vulnerability/PYSEC-2023-172 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-41369 · Vendor Advisory
• https://me.sap.com/notes/3369680 · Note
• https://twitter.com/CVEnew/status/1701420507503923601 · Twitter Post