Authorization Flaw in SAP Business One Service Layer

CVE-2021-33704

Summary

The Service Layer of SAP Business One version 10.0 contains an authorization flaw that permits authenticated attackers to access functions typically restricted to certain users. This vulnerability is concerning as it allows attackers to exploit functions without needing extensive system knowledge. By leveraging this flaw through the network stack, an attacker could potentially read, modify, or delete sensitive data that should remain protected. The absence of proper authorization mechanisms could lead to significant abuse of functionalities reserved for authorized personnel.

References