CVE-2023-41369

External Entity Loop vulnerability in SAP S/4HANA (Create Single Payment application)

Low3.5EPSS 0.49%

Published: 12 Sept 2023
Updated: 25 Sept 2024
Reserved: 29 Aug 2023
Assigned by: sap

Description

The Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, 107, 108, allows an attacker to upload the XML file as an attachment. When clicked on the XML file in the attachment section, the file gets opened in the browser to cause the entity loops to slow down the browser.

Scores

CVSS scores of CVE-2023-41369, by who scored it
Scored by	CVSS	Score	Vector
sapCNA (assigner)	3.1	Low3.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
NVDNVD · Modified	3.1	Medium4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

EPSS (exploitation in 30 days): 0.49% · top 58% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.5.

Weakness

CWE-611: Improper Restriction of XML External Entity Reference (opens in a new tab)All about CWE-611 and its CVEs

Affected products

SAP_SE · SAP S/4HANA (Create Single Payment application)
- affected 100
- affected 101
- affected 102
- affected 103
- affected 104
- affected 105
- affected 106
- affected 107
- affected 108

References (2)

https://me.sap.com/notes/3369680 (opens in a new tab)x_transferred
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2023-41369](https://trackcve.app/badge/CVE-2023-41369.svg)](https://trackcve.app/cve/CVE-2023-41369)

Record last updated 25 Sept 2024, 15:33 UTC.