CVE-2023-37487 MEDIUM

CVE-2023-37487: Security misconfiguration vulnerability in SAP Business One (Service Layer)

Vendor Sap_Se

Product SAP Business One (Service Layer)

Weakness CWE-497

Published August 8, 2023

Last update October 10, 2024

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity High

Privileges required Low

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

SAP Business One (Service Layer) - version 10.0, allows an authenticated attacker with deep knowledge perform certain operation to access unintended data over the network which could lead to high impact on confidentiality with no impact on integrity and availability of the application

Key dates

02Disclosure timeline

August 8, 2023 CVE published

October 10, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-37487 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/497.html

Related vulnerabilities

04Related CVE

CVE-2024-31223 Fides Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL CVE-2025-62083 WordPress BoomDevs WordPress Coming Soon plugin plugin <= 1.0.4 - Sensitive Data Exposure vulnerability CVE-2025-32026 Element Web could load a malicious instance of Element Call leaking media encryption keys CVE-2024-50528 WordPress Stacks Mobile App Builder plugin <= 5.2.3 - Sensitive Data Exposure vulnerability CVE-2025-46717 sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folders