CVE-2023-33993

Published Aug 8, 2023

Last updated a year ago

Overview

Description: B1i module of SAP Business One - version 10.0, application allows an authenticated user with deep knowledge to send crafted queries over the network to read or modify the SQL data. On successful exploitation, the attacker can cause high impact on confidentiality, integrity and availability of the application.
Source: cna@sap.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 5.9
Exploitability score: 1.6
Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

cna@sap.com: CWE-89

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:sap:business_one:10.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "391F491C-2DE8-44E5-B054-42F188161C8A"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References