CVE-2023-31403 Improper Access Control vulnerability in SAP Business One product installation

What is CVE-2023-31403?

CVE-2023-31403 is a critical missing authorization vulnerability in SAP_SE SAP Business One, published on 14 Nov 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

SAP Business One installation - version 10.0, does not perform proper authentication and authorization checks for SMB shared folder. As a result, any malicious user can read and write to the SMB shared folder. Additionally, the files in the folder can be executed or be used by the installation process leading to considerable impact on confidentiality, integrity and availability.

Weakness: CWE-863

Which versions are affected by CVE-2023-31403?

It affects 1 product.

Products include Sap Business One.

How do I fix CVE-2023-31403?

No fix has been published for CVE-2023-31403 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-31403 being exploited?

There is no known exploitation of CVE-2023-31403 in the wild and no public exploit code.

Other vulnerabilities in SAP_SE SAP Business One

• CVE-2021-33698 File upload in SAP Business One Critical 9.9
• CVE-2021-38180 Code injection in SAP Business One Critical 9.8
• CVE-2016-6256 XML external entity in n/a Critical 9.6
• CVE-2022-31593 Code injection in SAP Business One High 8.8
• CVE-2018-2425 Information disclosure in SAP Business One High 8.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mphg-6g5j-93fg.