Patch Day: March 2023
Released March 14, 2023 · 21 notes · Source: SAP Security Patch Day page
Scheduled for March 14, 2023 (second Tuesday)
- New
- 19
- Updated
- 2
- Critical
- 6
- High
- 4
- Highest CVSS
- 9.9
- Known exploited
- 0
Our summary
21 notes (19 new, 2 updated). 6 Critical and 4 High. Highest CVSS 9.9.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Code Injection vulnerability in SAP Business Objects Business Intelligence Platform (CMC)
Improper Access Control in SAP NetWeaver AS for Java
Improper access control in SAP NetWeaver AS Java (User Defined Search)
Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform (SAPRSBRO Program)
All notes
SAP’s introduction states 19 new notes and 2 updates; SAP’s table lists 21 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 21 of 21
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3245526 | Code Injection vulnerability in SAP Business Objects Business Intelligence Platform (CMC) New | SAP BusinessObjects BI Platform | Critical | 9.9 | CVE-2023-25616 |
| 3252433 | Improper Access Control in SAP NetWeaver AS for Java New | SAP NetWeaver AS Java | Critical | 9.9 | CVE-2023-23857 |
| 3273480 | Improper access control in SAP NetWeaver AS Java (User Defined Search) Update | SAP NetWeaver Process Integration | Critical | 9.9 | CVE-2022-41272 |
| 3294595 | Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Critical | 9.6 | CVE-2023-27269 |
| 3302162 | Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform (SAPRSBRO Program) New | SAP NetWeaver AS ABAP / ABAP Platform | Critical | 9.6 | CVE-2023-27500 |
| 3283438 | OS command execution vulnerability in SAP Business Objects Business Intelligence Platform (Adaptive Job Server) New | SAP BusinessObjects BI Platform | Critical | 9.0 | CVE-2023-25617 |
| 3296476 | Arbitrary Code Execution in SAP Solution Manager and ABAP managed systems (ST-PI) New | SAP Solution Manager and ABAP managed systems | High | 8.8 | CVE-2023-27893 |
| 3294954 | Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | High | 8.7 | CVE-2023-27501 |
| 3296346 | Multiple vulnerabilities in SAP NetWeaver AS for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | High | 7.4 | CVE-2023-26459, CVE-2023-25618 |
| 3275727 | Memory Corruption vulnerability in SAPOSCOL New | SAP Host Agent | High | 7.2 | CVE-2023-27498 |
| 3284550 | XXE vulnerability in SAP NetWeaver (SAP Enterprise Portal) New | SAP NetWeaver | Medium | 6.8 | CVE-2023-26461 |
| 3289844 | SQL Injection vulnerability in ABAP Platform New | SAP ABAP Platform | Medium | 6.8 | CVE-2023-25615 |
| 3287120 | Multiple vulnerabilities in the SAP BusinessObjects Business Intelligence platform New | SAP BusinessObjects BI Platform | Medium | 6.5 | CVE-2023-27271, CVE-2023-27896, CVE-2023-27894 |
| 3296328 | Denial of Service (DoS) in SAP NetWeaver AS for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.5 | CVE-2023-27270 |
| 3274585 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (BSP Framework) Update | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2023-25614 |
| 3274920 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver New | SAP NetWeaver | Medium | 6.1 | CVE-2023-0021 |
| 3281484 | Cross-Site Scripting (XSS) vulnerability in SAP Content Server New | SAP Content Server | Medium | 6.1 | CVE-2023-26457 |
| 3302710 | Information Disclosure vulnerability in SAP Authenticator for Android New | SAP Authenticator for Android | Medium | 6.1 | CVE-2023-27895 |
| 3288096 | Missing Authentication check in SAP NetWeaver AS for Java (Cache Management Service) New | SAP NetWeaver AS Java | Medium | 5.3 | CVE-2023-26460 |
| 3288394 | Improper Access Control in SAP NetWeaver AS Java (Classload Service) New | SAP NetWeaver AS Java | Medium | 5.3 | CVE-2023-24526 |
| 3288480 | Missing Authentication and Authorization check in SAP NetWeaver AS Java (Object Analyzing Service) New | SAP NetWeaver AS Java | Medium | 5.3 | CVE-2023-27268 |