SAP Business One B1_ON_HANA 10.0/SAP-M-BO 10.0 Service Layer session fixiation

Summaryinfo

A vulnerability marked as critical has been reported in SAP Business One B1_ON_HANA 10.0/SAP-M-BO 10.0. Affected is an unknown function of the component Service Layer. The manipulation leads to session fixiation. This vulnerability is uniquely identified as CVE-2025-26658. The attack is possible to be carried out remotely. No exploit exists. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in SAP Business One B1_ON_HANA 10.0/SAP-M-BO 10.0. It has been rated as critical. This issue affects an unknown code of the component Service Layer. The manipulation with an unknown input leads to a session fixiation vulnerability. Using CWE to declare the problem leads to CWE-384. Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The Service Layer in SAP Business One, allows attackers to potentially gain unauthorized access and impersonate other users in the application to perform unauthorized actions. Due to the improper session management, the attackers can elevate themselves to higher privilege and can read, modify and/or write new data. To gain authenticated sessions of other users, the attacker must invest considerable time and effort. This vulnerability has a high impact on the confidentiality and integrity of the application with no effect on the availability of the application.

The advisory is shared at me.sap.com. The identification of this vulnerability is CVE-2025-26658 since 02/12/2025. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 03/11/2025).

Applying a patch is able to eliminate this problem.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• SAP

Name

• Business One

Version

• B1_ON_HANA 10.0
• SAP-M-BO 10.0

License

• commercial

Website

• Vendor: https://www.sap.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion