CVE-2025-42933CWE-522

Insecure Storage of Sensitive Information in SAP Business One (SLD)

High · published September 9, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
20.7
In the wild
Unconfirmed
What it is

When a user logs in via SAP Business One native client, the SLD backend service fails to enforce proper encryption of certain APIs. This leads to exposure of sensitive credentials within http response body. As a result, it has a high impact on the confidentiality, integrity, and availability of the application.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00292 · 20.7th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2025-09-09T02:11Z
EPSS history
Timeline
  • 09 SEP 02:11Z
    Insecure Storage of Sensitive Information in SAP Business One (SLD)
    cvelistv5