Patch Day: November 2023
Released November 14, 2023 · 6 notes · Source: SAP Security Patch Day page
Scheduled for November 14, 2023 (second Tuesday)
- New
- 3
- Updated
- 3
- Critical
- 2
- High
- 0
- Highest CVSS
- 9.8
- Known exploited
- 0
Our summary
6 notes (3 new, 3 updated). 2 Critical and 0 High. Highest CVSS 9.8.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Missing Authorization check in SAP CommonCryptoLib
Improper Access Control vulnerability in SAP Business One product installation
All notes
SAP’s introduction states 3 new notes and 3 updates; SAP’s table lists 6 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 6 of 6
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3340576 | Missing Authorization check in SAP CommonCryptoLib Update | SAP CommonCryptoLib | Critical | 9.8 | CVE-2023-40309 |
| 3355658 | Improper Access Control vulnerability in SAP Business One product installation New | SAP Business One | Critical | 9.6 | CVE-2023-31403 |
| 3333426 | Server-Side Request Forgery in SAP NetWeaver AS Java (GRMG Heartbeat application) Update | SAP NetWeaver AS Java | Medium | 6.5 | CVE-2023-42477 |
| 2494184 | Cross-Site Request Forgery (CSRF) vulnerability in multiple SAP Sybase products Update | SAP SQL Anywhere | Medium | 6.3 | No CVE |
| 3362849 | Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 5.3 | CVE-2023-41366 |
| 3366410 | Information Disclosure in NetWeaver AS Java Logon New | SAP NetWeaver AS Java | Medium | 5.3 | CVE-2023-42480 |