CVE-2016-6256

Critical

Published: 26/05/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

SAP Business One for Android version 1.2.3 allows remote attackers to conduct XML External Entity (XXE) attacks via crafted XML data in a request to a specific endpoint.

Risk Assessment

An XXE attack may lead to the disclosure of sensitive data or system compromise, posing a serious security threat to the organization.

Recommendation

It is recommended to update SAP Business One to the latest version to mitigate the risks associated with this vulnerability.

Original NVD description (English source)

SAP Business One for Android 1.2.3 allows remote attackers to conduct XML External Entity (XXE) attacks via crafted XML data in a request to B1iXcellerator/exec/soap/vP.001sap0003.in_WCSX/com.sap.b1i.vplatform.runtime/INB_WS_CALL_SYNC_XPT/INB_WS_CALL_SYNC_XPT.ipo/proc, aka SAP Security Note 2378065.