Vulnerability · Published Sep 9, 2025 · Assigned by sap
CVE-2025-42933Insecure Storage of Sensitive Information in SAP Business One (SLD)
High 8.8
In plain English
A high-severity security flaw in SAP Business One (SLD) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.3%top 78.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
When a user logs in via SAP Business One native client, the SLD backend service fails to enforce proper encryption of certain APIs. This leads to exposure of sensitive credentials within http response body. As a result, it has a high impact on the confidentiality, integrity, and availability of the application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP Business One (SLD) | B1_ON_HANA 10.0SAP-M-BO 10.0 |
Weakness: CWE-522 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H