CRITICAL🇵🇱 Wersja polska

CVE-2016-6256

CVSS 9.6v3.0pub. 2017-05-26upd. 2026-05-13

SAP Business One for Android 1.2.3 allows remote attackers to conduct XML External Entity (XXE) attacks via crafted XML data in a request to B1iXcellerator/exec/soap/vP.001sap0003.in_WCSX/com.sap.b1i.vplatform.runtime/INB_WS_CALL_SYNC_XPT/INB_WS_CALL_SYNC_XPT.ipo/proc, aka SAP Security Note 2378065.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

  • Sap Business One

    APP
    Sap
    1.2.3
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
XXE
CWE
References

Related vulnerabilities

CVE-2023-31403CRITICAL9.6ten sam produkt

SAP Business One installation - version 10.0, does not perform proper authentication and authorization checks ...

CVE-2021-38180CRITICAL9.8ten sam produkt

SAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel (CSV injec...

CVE-2023-33993HIGH7.1ten sam produkt

B1i module of SAP Business One - version 10.0, application allows an authenticated user with deep knowledge to...

CVE-2023-39437HIGH7.6ten sam produkt

SAP business One allows - version 10.0, allows an attacker to insert malicious code into the content of a web ...

CVE-2022-35292HIGH7.8ten sam produkt

In SAP Business One application when a service is created, the executable path contains spaces and isn’t enclo...