Medium severity · published Sep 12, 2023
CVE-2023-41369
The Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, 107, 108, allows an attacker to upload the XML file as an attachment. When…
4.3
CVSS
0.5%
EPSS
No
On KEV
Description
The Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, 107, 108, allows an attacker to upload the XML file as an attachment. When clicked on the XML file in the attachment section, the file gets opened in the browser to cause the entity loops to slow down the browser.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SH
S/4 Hana · Sap
100; 101; 102; 103; 104; 105; +3 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-41369
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-41369
Permissions Required
https://me.sap.com/notes/3369680
Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
More from S/4 Hana
8.8
CVE-2020-6188
VAT Pro-Rata reports in SAP ERP (SAP_APPL versions 600, 602, 603, 604, 605, 606, 616 and SAP_FIN versions 617, 618, 700, 720, 730) and SAP S/4 HANA (versions 100, 101, 102, 103,…
7.6
CVE-2020-26832
SAP AS ABAP (SAP Landscape Transformation), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA (SAP Landscape…
7.2
CVE-2026-0498
Code Injection vulnerability in SAP S/4HANA (Private Cloud and On-Premise)
6.5
CVE-2024-34691
Missing Authorization check in SAP S/4HANA (Manage Incoming Payment Files)
5.3
CVE-2024-45282
HTTP Verb Tampering in SAP S/4 HANA(Manage Bank Statements)