SAP Business One creates memory dump files in which it writes sensitive application data without any obfuscation. If those files are accessed, an attacker can read confidential information and may use that knowledge to perform unauthorized operations, such as altering company data, thereby compromising both confidentiality and integrity.

The vulnerability affects SAP Business One (B1 Client) version 10.0. Users of this product are at risk unless refreshed.

The CVSS score of 5.8 indicates a medium severity, primarily due to the high confidentiality impact. The EPSS score of less than 1% shows a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The most probable attack vector is the ability to read the client’s local memory dump files; if an attacker can gain local or remote file system access, the vulnerability can be leveraged to retrieve sensitive data.