Patch Day: August 2023
Released August 8, 2023 · 18 notes · Source: SAP Security Patch Day page
Scheduled for August 8, 2023 (second Tuesday)
- New
- 15
- Updated
- 3
- Critical
- 2
- High
- 8
- Highest CVSS
- 9.8
- Known exploited
- 0
Our summary
18 notes (15 new, 3 updated). 2 Critical and 8 High. Highest CVSS 9.8.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Multiple Vulnerabilities in SAP PowerDesigner
OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL)
Improper authentication in SAP Commerce Cloud
Directory Traversal vulnerability in SAP NetWeaver (BI CONT ADD ON)
Code Injection vulnerability in SAP PowerDesigner
All notes
SAP’s introduction states 15 new notes and 3 updates; SAP’s table lists 18 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 18 of 18
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3341460 | Multiple Vulnerabilities in SAP PowerDesigner New | SAP PowerDesigner | Critical | 9.8 | CVE-2023-37483, CVE-2023-37484 |
| 3350297 | OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL) Update | SAP ECC and SAP S/4HANA | Critical | 9.1 | CVE-2023-36922 |
| 3346500 | Improper authentication in SAP Commerce Cloud New | SAP Commerce Cloud | High | 8.8 | CVE-2023-39439 |
| 3331376 | Directory Traversal vulnerability in SAP NetWeaver (BI CONT ADD ON) Update | SAP NetWeaver | High | 8.7 | CVE-2023-33989 |
| 3341599 | Code Injection vulnerability in SAP PowerDesigner New | SAP PowerDesigner | High | 7.8 | CVE-2023-36923 |
| 3317710 | Binary hijack in SAP BusinessObjects Business Intelligence Suite (installer) New | SAP BusinessObjects BI Platform | High | 7.6 | CVE-2023-37490 |
| 3358300 | Cross-Site Scripting (XSS) vulnerability in SAP Business One New | SAP Business One | High | 7.6 | CVE-2023-39437 |
| 3312047 | Denial of Service (DoS) vulnerability due to the usage of vulnerable version of Commons FileUpload in SAP BusinessObjects Business Intelligence Platform (CMC) New | SAP BusinessObjects BI Platform | High | 7.5 | No CVE |
| 3344295 | Improper Authorization check vulnerability in SAP Message Server New | SAP Message Server | High | 7.5 | CVE-2023-37491 |
| 3337797 | SQL Injection vulnerability in SAP Business One (B1i Layer) New | SAP Business One | High | 7.1 | CVE-2023-33993 |
| 2032723 | Switchable authorization checks for RFC in SRM Update | SAP Supplier Relationship Management | Medium | 6.3 | No CVE |
| 3350494 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Process Integration New | SAP NetWeaver Process Integration | Medium | 6.1 | CVE-2023-37488 |
| 3341934 | Information Disclosure vulnerability in SAP Commerce (OCC API) New | SAP Commerce Cloud | Medium | 5.9 | CVE-2023-37486 |
| 2067220 | Information Disclosure in SAP Supplier Relationship Management New | SAP Supplier Relationship Management | Medium | 5.8 | CVE-2023-39436 |
| 3333616 | Security Misconfiguration vulnerability in SAP Business One (Service Layer) New | SAP Business One | Medium | 5.3 | CVE-2023-37487 |
| 3348000 | Missing Authorization check in SAP NetWeaver AS ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.9 | CVE-2023-37492 |
| 3312586 | Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Medium | 4.4 | CVE-2023-39440 |
| 3358328 | Information disclosure vulnerability in SAP Host Agent New | SAP Host Agent | Low | 3.7 | CVE-2023-36926 |