CVE-2023-41369CWE-611

External Entity Loop vulnerability in SAP S/4HANA (Create Single Payment application)

Low · published September 12, 2023

CVSS v3.1
3.5
EPSS
0%
Percentile
41.0
In the wild
Unconfirmed
What it is

The Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, 107, 108, allows an attacker to upload the XML file as an attachment. When clicked on the XML file in the attachment section, the file gets opened in the browser to cause the entity loops to slow down the browser.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00487 · 41.0th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2023-09-12T01:59Z
EPSS history
Timeline
  • 12 SEP 01:59Z
    External Entity Loop vulnerability in SAP S/4HANA (Create Single Payment application)
    cvelistv5