Patch Day: July 2023
Released July 11, 2023 · 18 notes · Source: SAP Security Patch Day page
Scheduled for July 11, 2023 (second Tuesday)
- New
- 16
- Updated
- 2
- Critical
- 2
- High
- 7
- Highest CVSS
- 10.0
- Known exploited
- 0
Our summary
18 notes (16 new, 2 updated). 2 Critical and 7 High. Highest CVSS 10.0.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Security updates for the browser control Google Chromium delivered with SAP Business Client
OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL)
Directory Traversal vulnerability in SAP NetWeaver (BI CONT ADD ON)
Request smuggling and request concatenation vulnerability in SAP Web Dispatcher
Stored Cross-Site Scripting vulnerability in SAP UI5 (Variant Management)
All notes
SAP’s introduction states 16 new notes and 2 updates; SAP’s table lists 18 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 18 of 18
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 2622660 | Security updates for the browser control Google Chromium delivered with SAP Business Client Update | SAP Business Client | Critical | 10.0 | No CVE |
| 3350297 | OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL) New | SAP ECC and SAP S/4HANA | Critical | 9.1 | CVE-2023-36922 |
| 3331376 | Directory Traversal vulnerability in SAP NetWeaver (BI CONT ADD ON) New | SAP NetWeaver | High | 8.7 | CVE-2023-33989 |
| 3233899 | Request smuggling and request concatenation vulnerability in SAP Web Dispatcher New | SAP Web Dispatcher | High | 8.6 | CVE-2023-33987 |
| 3324285 | Stored Cross-Site Scripting vulnerability in SAP UI5 (Variant Management) Update | SAP UI5 Variant Management | High | 8.2 | CVE-2023-33991 |
| 3331029 | Denial of service (DOS) vulnerability in SAP SQL Anywhere New | SAP SQL Anywhere | High | 7.8 | CVE-2023-33990 |
| 3340735 | Memory Corruption vulnerability in SAP Web Dispatcher New | SAP Web Dispatcher | High | 7.7 | CVE-2023-35871 |
| 3348145 | Header Injection in SAP Solution Manager (Diagnostic Agent) New | SAP Solution Manager | High | 7.2 | CVE-2023-36921 |
| 3352058 | Unauthenticated blind SSRF in SAP Solution Manager (Diagnostics agent) New | SAP Solution Manager | High | 7.2 | CVE-2023-36925 |
| 3343547 | Missing Authentication check in SAP NetWeaver Process Integration (Runtime Workbench) New | SAP NetWeaver Process Integration | Medium | 6.5 | CVE-2023-35873 |
| 3343564 | Missing Authentication check in SAP NetWeaver Process Integration (Message Display Tool) New | SAP NetWeaver Process Integration | Medium | 6.5 | CVE-2023-35872 |
| 3341211 | Improper Access Control in SAP S/4HANA (Manage Journal Entry Template) New | SAP S/4HANA | Medium | 6.3 | CVE-2023-35870 |
| 3326769 | Multiple Vulnerabilities in SAP Enable Now New | SAP Enable Now | Medium | 6.1 | CVE-2023-33988, CVE-2023-36918, CVE-2023-36920, CVE-2023-36919 |
| 3318850 | Improper authentication vulnerability in SAP NetWeaver AS ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.0 | CVE-2023-35874 |
| 3320702 | Password Change rate limit bypass in SAP BusinessObjects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Medium | 5.9 | CVE-2023-36917 |
| 3324732 | Log Injection vulnerability in SAP NetWeaver AS for Java (Log Viewer) New | SAP NetWeaver AS Java | Medium | 5.3 | CVE-2023-31405 |
| 3351410 | Log Injection vulnerability in SAP ERP Defense Forces and Public Security New | SAP ERP Defense Forces and Public Security | Medium | 4.9 | CVE-2023-36924 |
| 3088078 | Missing Authorization Check in SAP Business Warehouse and SAP BW/4HANA New | SAP Business Warehouse and SAP BW/4HANA | Medium | 4.5 | CVE-2023-33992 |