SAP Business One Broken Authorization Vulnerability Allowing Privilege Escalation

A broken authorization vulnerability in SAP Business One (SLD) enables an authenticated attacker to gain administrator privileges over a database by calling the relevant API. This vulnerability significantly impacts the application's confidentiality, integrity, and availability.

Impact

Exploitation of this vulnerability allows an authenticated attacker to gain administrator privileges on a database, leading to a high impact on the application's confidentiality, integrity, and availability.

Remediation

Users are advised to review and implement the SAP Security Note associated with this vulnerability. This can be done through the SAP for Me platform, specifically in the Security Notes section. SAP Security Patch Day is scheduled for the second Tuesday of every month, when SAP publishes important security updates.