SAP Business One SLD Backend Service API Encryption Vulnerability Leading to Credential Exposure

A vulnerability exists in the SAP Business One native client login process, where the SLD backend service improperly encrypts certain APIs. This flaw allows sensitive credentials to be exposed in the HTTP response body, significantly impacting the application's confidentiality, integrity, and availability.

Impact

Exploitation of this vulnerability leads to the exposure of sensitive credentials, with high implications for the application's confidentiality, integrity, and availability.

Remediation

Users are advised to review and implement the SAP Security Note related to this vulnerability, available through the SAP for Me platform. This vulnerability will also be addressed in the upcoming SAP Security Patch Day.