Cyber Resilience

CVE-2023-41369

Low

Published: 12 September 2023

Published
12 September 2023
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
EPSS Score 0.0014 33.4th percentile
Risk Priority 7 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-41369 is a low-severity Improper Restriction of XML External Entity Reference (CWE-611) vulnerability in Sap S\/4 Hana. Its CVSS base score is 3.5 (Low).

Operationally, ranked at the 33.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

The Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, 107, 108, allows an attacker to upload the XML file as an attachment. When clicked on the XML file in the attachment section,…

more

the file gets opened in the browser to cause the entity loops to slow down the browser.

CWE(s)
CWE-611

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

sap
s\/4 hana
100, 101, 102, 103, 104

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing
addresses: CWE-611

Penetration testing includes XML external entity payloads, detecting XXE vulnerabilities and enabling their mitigation.

SI-4 System Monitoring
addresses: CWE-611

Identifies XML external entity processing via monitoring of unusual file/network access or resource usage.

References