CVE-2023-41369: sap_se sap s/4hana (create single payment application)

Vulnerability summary

CVE-2023-41369 is a medium (CVSS 4.3) vulnerability in sap_se sap s/4hana (create single payment application). EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 40.9% of scored vulnerabilities.

Timeline

1. 12-09-2023
   PublishedVulnerability first disclosed.
2. 25-09-2024
   Last modifiedVulnerability information updated.

Description

The Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, 107, 108, allows an attacker to upload the XML file as an attachment. When clicked on the XML file in the attachment section, the file gets opened in the browser to cause the entity loops to slow down the browser.

• CWE-611Improper Restriction of XML External Entity ReferenceThe product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.