{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"hana-ml","cve_ids":["CVE-2023-41369"],"ecosystem":"PyPI","epss":0.00487,"exploited":false,"fixed_versions":[],"id":"tcs_01M5KGJPADGKRHX5S302Q9XQJP","modified_at":"2025-10-09T08:26:28.470879Z","published_at":"2023-09-12T02:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-172","https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html","https://me.sap.com/notes/3369680"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"PYSEC-2023-172","url":"https://osv.dev/vulnerability/PYSEC-2023-172"}],"summary":"The Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, 107, 108, allows an attacker to upload the XML file as an attachment. When clicked on the XML file in"}