title: Security misconfiguration vulnerability in SAP Business One (Service Layer)
description: SAP Business One (Service Layer) - version 10.0, allows an authenticated attacker with deep knowledge perform certain operation to access unintended data over the network which could lead to high impact on confidentiality with no impact on integrity and availability of the application
problem types: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
affected:
{
defaultStatus: unaffected
product: SAP Business One (Service Layer)
vendor: SAP_SE
versions:
status: affected, version: 10.0
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL