Login Request a demo
Medium severity · published Aug 8, 2023
CVE-2023-37487
Security misconfiguration vulnerability in SAP Business One (Service Layer)
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
SAP Business One (Service Layer) - version 10.0, allows an authenticated attacker with deep knowledge perform certain operation to access unintended data over the network which could lead to high impact on confidentiality with no impact on integrity and availability of the application
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
SAP Business One (Service Layer) · SAP_SE
10.0 · source: vendor
BO
Business One · Sap
10.0 · source: NVD
Affected product
SB
SAP Business One (Service Layer)
SAP_SE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-37487
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-37487
Permissions Required
https://me.sap.com/notes/3333616
Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
More from SAP Business One (Service Layer)
6.8
CVE-2025-26658
Broken Authentication in SAP Business One (Service Layer)