CVE-2025-42933: SAP Business One Information Disclosure

CVE-2025-42933 Overview

CVE-2025-42933 affects the System Landscape Directory (SLD) backend service used by SAP Business One. When a user authenticates through the SAP Business One native client, the SLD backend fails to enforce encryption on certain APIs. Sensitive credentials are exposed within the HTTP response body, allowing an authenticated attacker on the network to harvest them. The flaw maps to [CWE-522: Insufficiently Protected Credentials] and carries a CVSS 3.1 base score of 8.8. Successful exploitation produces high impact on confidentiality, integrity, and availability of the SAP Business One application.

Critical Impact
An authenticated network attacker can capture plaintext credentials returned by SLD APIs and reuse them to compromise SAP Business One systems.

Affected Products

SAP Business One native client integrations with the SLD backend service
SAP Business One System Landscape Directory (SLD) component
Refer to SAP Note #3642961 for the exact affected versions

Discovery Timeline

2025-09-09 - CVE-2025-42933 published to the National Vulnerability Database
2025-09-09 - SAP publishes SAP Note #3642961 on SAP Security Patch Day
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-42933

Vulnerability Analysis

The SLD backend service handles landscape registration and credential management for SAP Business One installations. During native client login, the service exchanges configuration and credential data with the client over HTTP. Specific APIs in the SLD backend do not enforce transport-layer encryption or response-body protection. As a result, the server returns sensitive credentials inside HTTP response bodies. Any attacker positioned to authenticate to the SLD endpoint, or observe its responses, can extract those credentials.

The exposed credentials can then be replayed against SAP Business One components. Because credentials may grant administrative or service-level access, the attacker can read business data, modify records, and disrupt service availability. The flaw is exploitable across the network with low attack complexity and requires only low-privileged authentication.

Root Cause

The root cause is improper credential protection in the SLD backend API layer, classified under [CWE-522]. The service treats certain API endpoints as internal and returns credential material in plaintext within JSON or XML response bodies. Encryption controls that should apply to these endpoints are not enforced, leaving credentials available to any caller of the API.

Attack Vector

The attack vector is network-based. An authenticated user, or an attacker who has obtained any low-privileged SAP Business One account, invokes the vulnerable SLD APIs during or after the native client login flow. The server responds with credentials embedded in the HTTP body. The attacker harvests these values from the response and uses them to escalate access or pivot to additional SAP Business One services.

No verified public exploit code is available. The vulnerability is described in prose; consult SAP Note #3642961 for vendor technical details.

Detection Methods for CVE-2025-42933

Indicators of Compromise

HTTP responses from SLD backend endpoints containing credential fields such as password, secret, or token in cleartext
Repeated calls from a single SAP Business One client account to SLD APIs outside the normal login sequence
Reuse of SAP Business One service credentials from unexpected client IPs shortly after SLD API access

Detection Strategies

Inspect SLD backend HTTP traffic at a proxy or WAF for response bodies that contain credential keywords
Correlate SLD API access logs with subsequent authentication events to identify credential replay
Hunt for SAP Business One accounts that query SLD APIs they have not historically used

Monitoring Recommendations

Forward SLD backend access logs and SAP Business One authentication logs to a centralized SIEM for correlation
Alert on any SLD API response over 95th-percentile size or containing credential field names
Track failed and successful logins per service account to detect harvested-credential reuse

How to Mitigate CVE-2025-42933

Immediate Actions Required

Apply the patch referenced in SAP Note #3642961 on all SAP Business One systems exposing the SLD backend
Rotate all SAP Business One service and integration credentials that may have been returned by SLD APIs
Restrict network access to the SLD backend to trusted management subnets only
Review SLD and SAP Business One logs for prior access to the affected APIs

Patch Information

SAP released the fix on SAP Security Patch Day. Administrators should review SAP Note #3642961 for the exact patch level and apply it to all affected SAP Business One installations. The patch enforces encryption on the affected SLD APIs and removes credential material from response bodies.

Workarounds

Place the SLD backend behind a reverse proxy that enforces TLS and strips credential fields from response bodies
Limit SLD API access through firewall rules to authorized administrative hosts
Reduce privileges of SAP Business One service accounts until the patch is deployed
Monitor SLD traffic continuously and alert on credential patterns in responses

bash

# Example: restrict SLD backend access to a management subnet (iptables)
iptables -A INPUT -p tcp --dport 40000 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 40000 -j DROP