TI-2021-15858 Aliases CVE-2021-38180 GHSA-h8r6-3pj7-gwfh

CSV injection in SAP Business One

MEDIUM 46CWE-1236Published 2021-10-12 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

SAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel (CSV injection) due to improper sanitation during the data export. An attacker could thereby execute arbitrary commands on the victim's computer but only if the victim allows to execute macros while opening the file and the security settings of Excel allow for command execution.

Why it matters now

EPSS 0.02053 81st percentileScored 2026-11-07

Fix Fixed SAP Business One (SAP SE): 10.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP Business One	before 10.0	10.0	Patch available	CNA

SAP Business One VendorSAP Affected before 10.0 Fixed in 10.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:business_one:10.0:::::::*	10.0	Vulnerable	SAP

cpe:2.3:a:sap:business_one:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·SAP

Remediation

Fix · CNA SAP Business One (SAP SE) Fixed in 10.0

Timeline

2026-10-02 Threatist record created from CVE-2021-38180
2026-10-03 Alias added: GHSA-h8r6-3pj7-gwfh

References

Advisory 1

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983

Other 1

https://launchpad.support.sap.com/#/notes/3079427

TI-2016-05359 SAP Business One for Android 1.2.3 allows remote attackers to conduct XML External Entity… CVSS 3.0CRITICAL 9.6
TI-2023-15021 Improper Access Control vulnerability in SAP Business One product installation CVSS 3.1CRITICAL 9.6
TI-2022-13517 Injection in SAP Business One CVSS 3.1HIGH 8.8
TI-2021-13072 Unrestricted file upload in SAP Business One CVSS 3.1HIGH 8.8
TI-2021-13078 Missing authorization in SAP Business One CVSS 3.1HIGH 8.8
TI-2018-01810 Under certain conditions, SAP Business One, 9.2, 9.3, for SAP HANA backup service allows… CVSS 3.0HIGH 8.4

See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences