Introduction
SAP Business One, a widely used ERP platform for small and midsize businesses, has a high-severity vulnerability (CVE-2025-42933) in its System Landscape Directory (SLD) component. Credentials can be exposed in HTTP responses because the SLD does not enforce encryption strictly enough when a user authenticates through the native client. In an ERP system, exposed credentials can lead to unauthorized access, data manipulation, and operational disruption.
About SAP and SAP Business One: SAP's enterprise software is used by over 400,000 organizations around the world, across many industries. SAP Business One is a core SAP ERP product for small and midsize enterprises. It manages financials, inventory, and operations. The SLD component is central to authentication and system management in SAP Business One deployments.
Technical Information
CVE-2025-42933 is classified under CWE-522 (Insufficiently Protected Credentials). The problem appears when a user logs in through the SAP Business One native client. On certain API endpoints, the SLD backend service does not enforce proper encryption, and sensitive credentials end up in the HTTP response body. If that response travels in plaintext or with inadequate cryptographic protection, an attacker with network access can intercept it.
The SLD handles authentication, database connectivity, and system configuration. SAP's administrative documentation says communication with the SLD should use HTTPS with certificate-based authentication. CVE-2025-42933 indicates that not every API flow follows that rule, and the gap leads to credential leakage. No public code snippets or detailed exploit information are available for this vulnerability.
Affected Systems and Versions
- Product: SAP Business One
- Component: System Landscape Directory (SLD)
- Affected versions: Not explicitly listed in public sources. Check SAP Security Note 3642961 for exact version details and patch applicability.
- Vulnerable configuration: Systems where users authenticate via the native SAP Business One client and SLD backend APIs are exposed.
Vendor Security History
SAP has a documented history of authentication and authorization vulnerabilities in Business One and related products. CVE-2025-42951, for example, also affects the SLD component and allows authorization bypass. Other recent vulnerabilities in SAP Business One include improper access control, missing authentication, and information disclosure issues. SAP releases patches on a monthly cycle and has improved its response times, but critical flaws keep recurring in its authentication infrastructure.
