PT-2025-36560 · Sap · Sap Business One

Published 2025-09-09 · Updated 2025-09-14 · CVE-2025-42933

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: SAP Business One (affected versions not specified)

Description: A flaw exists in the SLD backend service of SAP Business One when a user logs in via the native client. The service fails to enforce proper encryption of certain APIs, leading to the exposure of sensitive credentials within the HTTP response body. This impacts the confidentiality, integrity, and availability of the application.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BDU:2025-12402

CVE-2025-42933

Affected Products

Sap Business One

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-42933 · Security Note
• https://bdu.fstec.ru/vul/2025-12402 · Security Note
• https://t.me/CVEtracker/32032 · Telegram Post
• https://twitter.com/ZeroPathLabs/status/1965249326197727685 · Twitter Post
• https://twitter.com/RedPacketSec/status/1965354321068830880 · Twitter Post
• https://me.sap.com/notes/3642961 · Note
• https://twitter.com/cracbot/status/1967181595473039384 · Twitter Post
• https://twitter.com/CVEnew/status/1965244287936798798 · Twitter Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/september-2025.html · Note
• https://url.sap/sapsecuritypatchday · Note