Advisory
On 10.03.2026 a security relevant correction has been released by SAP SE. The manufacturer resolves an issue within SAP Business One.
SAP Note 3693543 addresses "3693543 - [CVE-2026-0489] DOM-based Cross-Site Scripting (XSS) Vulnerability in SAP Business One (Job Service)" to prevent cross-site scripting (xss) with a medium risk for exploitation.
A workaround does not exist, according to SAP Security Advisory team. It is advisable to implement the correction as monthly patch process, the team suggests.
Cross-site scripting (XSS) is the name of a class of security vulnerabilities that can occur in web-based
applications. XSS combines
all vulnerabilities that allow an attacker to inject HTML Markup and/or JavaScript into the front end of the
affected web application.
XSS attacks can occur whenever the application dynamically creates its HTML/JavaScript/CSS content, which is passed
to the
user's web browser, and attacker-controlled values are used in this process. If these values are included in the
generated code without proper validation and encoding, the attacker is able to include arbitrary
coding snippets into the application's front end. The code is then rendered by the victim's web browser and
interpreted in the victim's current authentication context.
Risk specification
SAP Business One Job Service allows an unauthenticated attacker to inject specially crafted input into a URL query parameter, potentially resulting in a DOM-based Cross-Site Scripting (XSS) vulnerability.
Solution
The vulnerability has been resolved by ensuring that redirect URLs are generated and validated by the backend service before being passed to the user interface, preventing the processing of untrusted input on the client side.
