PT-2025-46236 · Sap · Sap Business One Service Layer Directory+1

Published 2025-11-11 · Updated 2025-11-11 · CVE-2025-42897

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Business One versions (affected versions not specified)

Description An information disclosure issue exists in the anonymous API provided by SAP Business One Service Layer Directory (SLD). An attacker with normal user access may be able to obtain unauthorized information. This has a low impact on the confidentiality of the application, with no impact on integrity or availability. The affected API does not require authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BDU:2025-14480

CVE-2025-42897

Affected Products

Sap Business One

Sap Business One Service Layer Directory

References · 8

• https://bdu.fstec.ru/vul/2025-14480 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-42897 · Security Note
• https://twitter.com/CVEnew/status/1988077278199509407 · Twitter Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2025.html · Note
• https://t.me/CVEtracker/36974 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1988081081581502854 · Twitter Post
• https://me.sap.com/notes/3652901 · Note
• https://url.sap/sapsecuritypatchday · Note