In SAP Business One application when a service is created, the executable path contains spaces and isn’t enclosed within quotes, leading to a vulnerability known as Unquoted Service Path which allows a user to gain SYSTEM privileges. If the service is exploited by adversaries, it can be used to gain privileged permissions on a system or network leading to high impact on Confidentiality, Integrity, and Availability.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSap Business One
APPSap10.0
Related vulnerabilities
SAP Business One installation - version 10.0, does not perform proper authentication and authorization checks ...
SAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel (CSV injec...
SAP Business One for Android 1.2.3 allows remote attackers to conduct XML External Entity (XXE) attacks via cr...
B1i module of SAP Business One - version 10.0, application allows an authenticated user with deep knowledge to...
SAP business One allows - version 10.0, allows an attacker to insert malicious code into the content of a web ...