4.3

CVE-2023-41369

The Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, 107, 108, allows an attacker to upload the XML file as an attachment. When clicked on the XML file in the attachment section, the file gets opened in the browser to cause the entity loops to slow down the browser.

Data is provided by the National Vulnerability Database (NVD)
SAP ≫ S/4 Hana Version100
SAP ≫ S/4 Hana Version101
SAP ≫ S/4 Hana Version102
SAP ≫ S/4 Hana Version103
SAP ≫ S/4 Hana Version104
SAP ≫ S/4 Hana Version105
SAP ≫ S/4 Hana Version106
SAP ≫ S/4 Hana Version107
SAP ≫ S/4 Hana Version108
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.11% 0.305
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
cna@sap.com 3.5 2.1 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
CWE-611 Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

https://me.sap.com/notes/3369680
Permissions Required