Patch Day: September 2023
Released September 12, 2023 · 18 notes · Source: SAP Security Patch Day page
Scheduled for September 12, 2023 (second Tuesday)
- New
- 13
- Updated
- 5
- Critical
- 5
- High
- 2
- Highest CVSS
- 10.0
- Known exploited
- 0
Our summary
18 notes (13 new, 5 updated). 5 Critical and 2 High. Highest CVSS 10.0.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Security updates for the browser control Google Chromium delivered with SAP Business Client
Code Injection vulnerability in SAP Business Objects Business Intelligence Platform (CMC)
Improper access control in SAP NetWeaver AS Java (User Defined Search)
Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management)
Missing Authorization check in SAP CommonCryptoLib
All notes
SAP’s introduction states 13 new notes and 5 updates; SAP’s table lists 18 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 18 of 18
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 2622660 | Security updates for the browser control Google Chromium delivered with SAP Business Client Update | SAP Business Client | Critical | 10.0 | No CVE |
| 3245526 | Code Injection vulnerability in SAP Business Objects Business Intelligence Platform (CMC) Update | SAP BusinessObjects BI Platform | Critical | 9.9 | CVE-2023-25616 |
| 3273480 | Improper access control in SAP NetWeaver AS Java (User Defined Search) Update | SAP NetWeaver Process Integration | Critical | 9.9 | CVE-2022-41272 |
| 3320355 | Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management) New | SAP BusinessObjects BI Platform | Critical | 9.9 | CVE-2023-40622 |
| 3340576 | Missing Authorization check in SAP CommonCryptoLib New | SAP CommonCryptoLib | Critical | 9.8 | CVE-2023-40309 |
| 3370490 | Insufficient File type validation in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) New | SAP BusinessObjects BI Platform | High | 8.7 | CVE-2023-42472 |
| 3327896 | Memory Corruption vulnerability in SAP CommonCryptoLib New | SAP CommonCryptoLib | High | 7.5 | CVE-2023-40308 |
| 3357163 | Code Injection vulnerability in SAP PowerDesigner Client New | SAP PowerDesigner Client | Medium | 6.3 | CVE-2023-40621 |
| 3317702 | Arbitrary File Delete via Directory Junction in SAP BusinessObjects Suite(installer) New | SAP BusinessObjects Suite | Medium | 6.2 | CVE-2023-40623 |
| 3149794 | Cross-Site Scripting (XSS) vulnerabilities in jQuery-UI library bundled with SAPUI5 Update | SAPUI5 | Medium | 6.1 | CVE-2021-41184, CVE-2021-41183, CVE-2021-41182 |
| 3156972 | URL Redirection vulnerability in SAP S/4HANA (Manage Catalog Items and Cross-Catalog search) Update | SAP S/4HANA | Medium | 6.1 | CVE-2023-40306 |
| 3349805 | Denial of service (DOS) vulnerability due to the usage of vulnerable version of Commons FileUpload in SAP Quotation Management Insurance (FS-QUO) New | SAP Quotation Management Insurance | Medium | 5.7 | CVE-2023-24998 |
| 3323163 | Code Injection vulnerability in SAP NetWeaver AS ABAP (applications based on Unified Rendering) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 5.5 | CVE-2023-40624 |
| 3326361 | Missing Authorization check in S4CORE (Manage Purchase Contracts App) New | S4CORE | Medium | 5.4 | CVE-2023-40625 |
| 3348142 | Missing Authentication check in SAP NetWeaver (Guided Procedures) New | SAP NetWeaver | Medium | 5.3 | CVE-2023-41367 |
| 3352453 | Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Version Management System) New | SAP BusinessObjects BI Platform | Medium | 5.3 | CVE-2023-37489 |
| 3369680 | External Entity Loop vulnerability in SAP S/4HANA (Create Single Payment application) New | SAP S/4HANA | Low | 3.5 | CVE-2023-41369 |
| 3355675 | Insecure Direct Object Reference (IDOR) vulnerability in SAP S/4HANA (Manage checkbook apps) New | S4 HANA ABAP | Low | 2.7 | CVE-2023-41368 |