Insufficient Encryption in SAP Business One Client by SAP

CVE-2025-42933

What is CVE-2025-42933?

A security flaw exists in the SAP Business One native client where the SLD backend service does not enforce proper encryption for specific APIs during user login. This deficiency allows sensitive user credentials to be exposed within the HTTP response body, significantly compromising the confidentiality and integrity of the application. Organizations using affected versions must take immediate action to mitigate risks associated with this vulnerability.

References