CVE-2022-35168 (Denial of Service vulnerability in SAP Business one Version – 10.0 product of SAP SE)
The security team of Green Tick Nepal Pvt. Ltd. located in Kathmandu, Nepal discovered a Denial of Service vulnerability in SAP Business one Version – 10.0 product of SAP SE. Due to improper input sanitization of XML input in SAP Business One – version 10.0, an attacker can perform a denial-of-service attack rendering the system temporarily inoperative. This vulnerability has been classified as problematic and categorized as exploitable. The CWE definition for vulnerability is CWE-611.
SAP Business one Version – 10.0 software processes an XML file that can have XML entities with URIs that fix to files outside of the supposed sphere of control, causing the product to embed wrong files into its output. This Vulnerability has left more than 100k Android users affected.
Proof of Concept
The Security Team of Green Tick Nepal Pvt. Ltd. has not published a Proof of Concept (POC) for SAP Business One – version 10.0.
|CVE-2022-35168||Denial of Service vulnerability in SAP Business One||SAP Business One – version 10.0|
Responsible Disclosure Time
|12th July 2022||CVE Published
|12th Oct 2022||Advisory Planned Date|