Unauthenticated Remote Code Execution in SAP Business One License Service API - Version 10.0

CVE-2022-28771 · HIGH Severity

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Due to missing authentication check, SAP Business one License service API - version 10.0 allows an unauthenticated attacker to send malicious http requests over the network. On successful exploitation, an attacker can break the whole application making it inaccessible.

Learn more about our Api Penetration Testing.