CRITICAL🇵🇱 Wersja polska

CVE-2021-38180

CVSS 9.8v3.1pub. 2021-10-12upd. 2026-02-24

SAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel (CSV injection) due to improper sanitation during the data export. An attacker could thereby execute arbitrary commands on the victim's computer but only if the victim allows to execute macros while opening the file and the security settings of Excel allow for command execution.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Sap Business One

    APP
    Sap
    10.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2023-31403CRITICAL9.6PL ✓same product

SAP Business One: brak uwierzytelnienia do folderu SMB podczas instalacji

CVE-2016-6256CRITICAL9.6PL ✓same product

XXE w SAP Business One dla Android 1.2.3 — atak przez spreparowane dane XML

CVE-2023-33993HIGH7.1same product

B1i module of SAP Business One - version 10.0, application allows an authenticated user with deep knowledge to...

CVE-2023-39437HIGH7.6same product

SAP business One allows - version 10.0, allows an attacker to insert malicious code into the content of a web ...

CVE-2022-35292HIGH7.8same product

In SAP Business One application when a service is created, the executable path contains spaces and isn’t enclo...