SAP Business One, version - 10.0, allows a local attacker with access to the victims browser under certain circumstances, to login as the victim without knowing his/her password. The attacker could so obtain highly sensitive information which the attacker could use to take substantial control of the vulnerable application.
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Business_one | Sap | 10.0 (including) | 10.0 (including) |