CVE-2023-31403: sap_se sap business one Incorrect Authorization

Vulnerability summary

CVE-2023-31403 is a critical (CVSS 9.6) Incorrect Authorization vulnerability in sap_se sap business one. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 36.7% of scored vulnerabilities.

Timeline

1. 14-11-2023
   PublishedVulnerability first disclosed.
2. 11-06-2025
   Last modifiedVulnerability information updated.

Description

SAP Business One installation - version 10.0, does not perform proper authentication and authorization checks for SMB shared folder. As a result, any malicious user can read and write to the SMB shared folder. Additionally, the files in the folder can be executed or be used by the installation process leading to considerable impact on confidentiality, integrity and availability.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.