- 104/2023
- Critical
SAP has released security updates to address several vulnerabilities affecting multiple products. In addition, SAP also announced (6) updates to the previously released patch day security notes.
This month’s patch fixes several vulnerabilities affecting multiple SAP products such as SAP 3D Visual Enterprise License Manager, SAP BusinessObjects Intelligence Platform, SAP AS NetWeaver JAVA, SAP IBP EXCEL ADD-IN, SAP PowerDesigner (Proxy), SAP Commerce, SAP GUI for Windows, SAPUI5, SAP CRM (WebClient UI), SAP Business Planning and Consolidation, SAP Application Interface Framework (ODATA service), and Vendor Master Hierarchy.
The attacker could exploit some of these vulnerabilities to gain access, obtain sensitive information, escalate privileges, bypass security restrictions, cause denial of service attacks, or cause cross-site scripting.
Sample of the addressed vulnerabilities:
1. SAP BusinessObjects Business Intelligence Platform Information Disclosure Vulnerability (CVE-2023-28762):
- CVSS: 9.1
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Consequences: Obtain Information
2. SAP NetWeaver AS for JAVA Security Bypass Vulnerability (CVE-2023-30744):
- CVSS: 8.2
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Consequences: Bypass Security
Vulnerabilities
Mitigations
The enterprise should deploy this patch as soon as the testing phase is completed.