Patch Day: October 2023
Released October 10, 2023 · 9 notes · Source: SAP Security Patch Day page
Scheduled for October 10, 2023 (second Tuesday)
- New
- 7
- Updated
- 2
- Critical
- 1
- High
- 0
- Highest CVSS
- 10.0
- Known exploited
- 0
Our summary
9 notes (7 new, 2 updated). 1 Critical and 0 High. Highest CVSS 10.0.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Security updates for the browser control Google Chromium delivered with SAP Business Client
All notes
SAP’s introduction states 7 new notes and 2 updates; SAP’s table lists 9 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 9 of 9
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 2622660 | Security updates for the browser control Google Chromium delivered with SAP Business Client Update | SAP Business Client | Critical | 10.0 | No CVE |
| 3372991 | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Web Intelligence New | SAP BusinessObjects Web Intelligence | Medium | 6.8 | CVE-2023-42474 |
| 3333426 | Server-Side Request Forgery in SAP NetWeaver AS Java (GRMG Heartbeat application) New | SAP NetWeaver AS Java | Medium | 6.5 | CVE-2023-42477 |
| 3357154 | Missing XML Validation vulnerability in SAP PowerDesigner Client (BPMN2 import) New | SAP PowerDesigner Client | Medium | 6.5 | CVE-2023-40310 |
| 3219846 | Missing Authorization Check In S/4HANA (Manage Withholding Tax Items) New | SAP S/4HANA | Medium | 5.4 | CVE-2023-42473 |
| 3324732 | Log Injection vulnerability in SAP NetWeaver AS for Java (Log Viewer) Update | SAP NetWeaver AS Java | Medium | 5.3 | CVE-2023-31405 |
| 3371873 | Log Injection vulnerability in SAP NetWeaver AS for Java (Log Viewer) New | SAP NetWeaver AS Java | Medium | 5.3 | CVE-2023-31405 |
| 3222121 | Information Disclosure Vulnerability in Statutory Reporting New | SAP S/4HANA Core | Medium | 4.3 | CVE-2023-42475 |
| 3338380 | Information Disclosure vulnerability in SAP Business One (B1i) New | SAP Business One | Medium | 4.3 | CVE-2023-41365 |