Riskcovery

CVE-2023-41369

External Entity Loop vulnerability in SAP S/4HANA (Create Single Payment application)

State
Published
Severity
3.5 Low
Published
Sep 12, 2023
Updated
Sep 25, 2024
Reserved
Aug 29, 2023

Read the record on cve.org

Description

The Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, 107, 108, allows an attacker to upload the XML file as an attachment. When clicked on the XML file in the attachment section, the file gets opened in the browser to cause the entity loops to slow down the browser.

Scores

CVSSScoreVectorSource
3.13.5 LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:Lsap

Weaknesses

  • CWE-611 Improper Restriction of XML External Entity Reference

Affected Products

ProductVersions
SAP S/4HANA (Create Single Payment application)SAP_SE
  • 100Affected
  • 101Affected
  • 102Affected
  • 103Affected
  • 104Affected
  • 105Affected
  • 106Affected
  • 107Affected
  • 108Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.