PT-2025-10672 · Sap · Sap Business One

Published 2025-03-10 · Updated 2025-03-11 · CVE-2025-26658

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SAP Business One (affected versions not specified)

Description The issue in the Service Layer of SAP Business One allows attackers to potentially gain unauthorized access, impersonate other users, and perform unauthorized actions due to improper session management. This can lead to elevated privileges, enabling attackers to read, modify, and/or write new data. The exploitation requires significant time and effort to gain authenticated sessions of other users. The impact is high on the confidentiality and integrity of the application, with no effect on its availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Session Fixation

Weakness Enumeration

CWE-862

CWE-384

Related Identifiers

BDU:2025-03174

CVE-2025-26658

Affected Products

Sap Business One

References · 11

• https://bdu.fstec.ru/vul/2025-03174 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-26658 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-26658 · Security Note
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 · Note
• https://me.sap.com/notes/3561045 · Note
• https://t.me/cvedetector/20015 · Telegram Post
• https://accounts.sap.com/saml2/idp/sso · Note
• https://t.me/cvetracker/18870 · Telegram Post
• https://url.sap/sapsecuritypatchday · Note
• https://cybersecurity-help.cz/vdb/SB2025031131 · Note
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/march-2025.html · Note