CVE-2021-37532: sap_se sap business one Path Traversal

Vulnerability summary

CVE-2021-37532 is a medium (CVSS 4.3) Path Traversal vulnerability in sap_se sap business one. EPSS estimates a 0.81% chance of exploitation in the next 30 days, higher than 56.4% of scored vulnerabilities.

Timeline

1. 14-09-2021
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

SAP Business One version - 10, due to improper input validation, allows an authenticated User to gain access to directory and view the contents of index in the directory, which would otherwise be restricted to high privileged User.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.