Patch Day: April 2023
Released April 11, 2023 · 24 notes · Source: SAP Security Patch Day page
Scheduled for April 11, 2023 (second Tuesday)
- New
- 19
- Updated
- 5
- Critical
- 5
- High
- 1
- Highest CVSS
- 10.0
- Known exploited
- 0
Our summary
24 notes (19 new, 5 updated). 5 Critical and 1 High. Highest CVSS 10.0.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Security updates for the browser control Google Chromium delivered with SAP Business Client
Multiple vulnerabilities in SAP Diagnostics Agent (OSCommand Bridge and EventLogServiceCollector)
Improper access control in SAP NetWeaver AS Java (User Defined Search)
Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management)
Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
All notes
SAP’s introduction states 18 new notes and 5 updates; SAP’s table lists 24 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 24 of 24
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 2622660 | Security updates for the browser control Google Chromium delivered with SAP Business Client Update | SAP Business Client | Critical | 10.0 | No CVE |
| 3305369 | Multiple vulnerabilities in SAP Diagnostics Agent (OSCommand Bridge and EventLogServiceCollector) New | SAP Diagnostics Agent | Critical | 10.0 | CVE-2023-27497, CVE-2023-27267 |
| 3273480 | Improper access control in SAP NetWeaver AS Java (User Defined Search) Update | SAP NetWeaver Process Integration | Critical | 9.9 | CVE-2022-41272 |
| 3298961 | Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management) New | SAP BusinessObjects BI Platform | Critical | 9.8 | CVE-2023-28765 |
| 3294595 | Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform Update | SAP NetWeaver AS ABAP / ABAP Platform | Critical | 9.6 | CVE-2023-27269 |
| 3305907 | Directory Traversal vulnerability in SAP NetWeaver (BI CONT ADD ON) New | SAP NetWeaver | High | 8.7 | CVE-2023-29186 |
| 3312733 | Information Disclosure vulnerability in SAP Landscape Management New | SAP Landscape Management | Medium | 6.8 | CVE-2023-26458 |
| 3311624 | DLL Hijacking vulnerability in SapSetup (Software Installation Program) New | SapSetup | Medium | 6.7 | CVE-2023-29187 |
| 3289994 | Missing Authentication check in SAP NetWeaver Enterprise Portal New | SAP NetWeaver Enterprise Portal | Medium | 6.5 | CVE-2023-28761 |
| 3290901 | Missing Authorization Check in SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests) Update | SAP Fiori apps 1.0 for travel management in SAP ERP | Medium | 6.5 | CVE-2023-24528 |
| 3296378 | Denial of Service in SAP NetWeaver AS for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.5 | CVE-2023-28763 |
| 3275458 | Cross-Site Scripting (XSS) vulnerability in SAP GUI for HTML New | SAP GUI for HTML | Medium | 6.1 | CVE-2023-27499 |
| 3309056 | Code Injection vulnerability in SAP CRM New | SAP CRM | Medium | 6.0 | CVE-2023-27897 |
| 3000663 | HTTP Request Smuggling in SAP Web Dispatcher and Internet Communication Manager Update | SAP Web Dispatcher and Internet Communication Manager | Medium | 5.4 | CVE-2021-33683 |
| 3269352 | HTTP Verb Tampering vulnerability in SAP CRM WebClient UI New | SAP CRM | Medium | 5.4 | CVE-2023-29189 |
| 3287784 | Improper Access Control in SAP NetWeaver AS Java for Deploy Service New | SAP NetWeaver AS Java for Deploy Service | Medium | 5.3 | CVE-2023-24527 |
| 3303060 | Denial of Service (DOS) in SAP NetWeaver AS for ABAP (Business Server Pages) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 5.3 | CVE-2023-29185 |
| 3315312 | IP filter vulnerability in ABAP Platform and SAP Web Dispatcher New | ABAP Platform and SAP Web Dispatcher | Medium | 5.0 | CVE-2023-29108 |
| 3316509 | Remote Code Execution vulnerability in SAP Commerce New | SAP Commerce Cloud | Medium | 4.7 | CVE-2020-13936 |
| 3115598 | Code Injection vulnerability in SAP Application Interface Framework (Log Message View of Message Dashboard) New | SAP Application Interface Framework | Medium | 4.4 | CVE-2023-29109 |
| 3301457 | Missing Authorization check in SAP HCM Fiori App My Forms (Fiori 2.0) New | SAP HCM Fiori App My Forms | Medium | 4.3 | CVE-2023-1903 |
| 3113349 | Code Injection vulnerability in SAP Application Interface Framework (Custom Hint of Message Dashboard) New | SAP Application Interface Framework | Low | 3.7 | CVE-2023-29110 |
| 3114489 | Code Injection vulnerability in SAP Application Interface Framework (Message Monitoring and Message Monitoring for Administrators Application) New | SAP Application Interface Framework | Low | 3.7 | CVE-2023-29112 |
| 3117978 | Information Disclosure vulnerability in SAP Application Interface Framework (ODATA service) New | SAP Application Interface Framework | Low | 3.1 | CVE-2023-29111 |