CVE-2018-2502: SAP Business One On Hana

Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days.

TRACE method is enabled in SAP Business One Service Layer . Attacker can use XST (Cross Site Tracing) attack if frontend applications that are using Service Layer has a XSS vulnerability. This has been fixed in SAP Business One Service Layer (B1_ON_HANA, versions 9.2, 9.3).

Affected products

• SAP Business One On Hana: version 9.2 only; version 9.3 only

Published 2018-12-11. Last modified 2026-06-17.