Diterjemahkan oleh mesin; mungkin terdapat kesilapan. (Machine-translated; may contain errors.) Baca versi bahasa Inggeris (Read in English)
Hari Tampalan Keselamatan SAP: Februari 2023
Diterbitkan pada 14 Februari 2023 · 21 nota · Sumber: rekod CVE di CVE.org (SAP sebagai CNA)
Dijadualkan pada 14 Februari 2023 (Selasa kedua)
- Nota SAP
- 21
- Kritikal
- 0
- Tinggi
- 3
- CVSS tertinggi
- 8.8
- Diketahui dieksploitasi
- 0
Keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP: CVSS 9.0 atau lebih ialah Kritikal, 7.0 atau lebih Tinggi, 4.0 atau lebih Sederhana, bawah 4.0 Rendah. Keutamaan SAP sendiri hanya terdapat di SAP for Me (log masuk SAP diperlukan).
Ringkasan kami
21 nota dengan CVE SAP. 0 Kritikal dan 3 Tinggi (keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP). CVSS tertinggi 8.8.
Tampalan yang perlu didahulukan
Disusun mengikut: eksploitasi yang diketahui (CISA KEV), kemudian keutamaan (diterbitkan daripada CVSS, bukan keutamaan SAP), kemudian CVSS. Ini alat bantu triaj, bukan pengganti penilaian risiko anda sendiri.
An attacker authenticated as a non-admin user with local access to a server port assigned to the SAP Host Agent (Start Service) - versions 7.21, 7.22, can submit a crafted ConfigureOutsideDiscovery r…
SAP BusinessObjects Business Intelligence platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise restricted.
SAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an authenticated admin user to upload malicious code that can be executed by the application over the network.
Perlukan triaj nota bulan ini untuk landskap anda sendiri? Khidmat keselamatan SAP (digitaldisciple.dev)
Semua nota
Keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP: CVSS 9.0 atau lebih ialah Kritikal, 7.0 atau lebih Tinggi, 4.0 atau lebih Sederhana, bawah 4.0 Rendah. Keutamaan SAP sendiri hanya terdapat di SAP for Me (log masuk SAP diperlukan).
Liputan: laman ini disusun daripada rekod CVE SAP, jadi nota tanpa CVE, nota yang hanya mempunyai CVE pihak ketiga (contohnya Apache atau OpenSSL), dan kemas kini kepada nota terdahulu tidak diliputi. Jumlahnya kira-kira 7% daripada nota baharu.
Memaparkan 21 daripada 21
| Tajuk | CVE | ||||
|---|---|---|---|---|---|
| 3285757 | An attacker authenticated as a non-admin user with local access to a server port assigned to the SAP Host Agent (Start Service) - versions 7.21, 7.22, can submit a crafted ConfigureOutsideDiscovery r… Baharu | Host Agent Service | Tinggi | 8.8 | CVE-2023-24523 |
| 3263135 | SAP BusinessObjects Business Intelligence platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise restricted. Baharu | SAP BusinessObjects BI Platform | Tinggi | 8.5 | CVE-2023-0020 |
| 3256787 | SAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an authenticated admin user to upload malicious code that can be executed by the application over the network. Baharu | BusinessObjects Business Intelligence Platform | Tinggi | 8.4 | CVE-2023-24530 |
| 2985905 | SAP S/4 HANA Map Treasury Correspondence Format Data does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. Baharu | SAP S/4HANA | Sederhana | 6.5 | CVE-2023-24524 |
| 3265846 | SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read or modify some sensit… Baharu | Solution Manager | Sederhana | 6.5 | CVE-2023-0024 |
| 3267442 | SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read or modify some sensit… Baharu | Solution Manager | Sederhana | 6.5 | CVE-2023-0025 |
| 3270509 | SAP Solution Manager - version 720, allows an authenticated attacker to redirect users to a malicious site due to insufficient URL validation. Baharu | Solution Manager | Sederhana | 6.5 | CVE-2023-23855 |
| 3281724 | In SAP GRC (Process Control) - versions GRCFND_A V1200, GRCFND_A V8100, GRCPINW V1100_700, GRCPINW V1100_731, GRCPINW V1200_750, remote-enabled function module in the proprietary SAP solution enables… Baharu | SAP GRC | Sederhana | 6.5 | CVE-2023-0019 |
| 3290901 | SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests) - version 600, allows an authenticated attacker to exploit a certain misconfigured application endpoint to view sensitive data. Baharu | Fiori apps 1.0 for travel management in SAP ERP | Sederhana | 6.5 | CVE-2023-24528 |
| 3266751 | SAP Solution Manager (System Monitoring) - version 720, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Baharu | Solution Manager | Sederhana | 6.1 | CVE-2023-23852 |
| 3268959 | SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an unauthenticated attacker to craft a malicious link, which when clicked by an un… Baharu | NetWeaver AS for ABAP and ABAP Platform | Sederhana | 6.1 | CVE-2023-23859, CVE-2023-23860 |
| 3269118 | Due to insufficient input sanitization, SAP NetWeaver AS ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, allows an unauthenticated user to alter the current session of the user by in… Baharu | NetWeaver AS ABAP | Sederhana | 6.1 | CVE-2023-24522 |
| 3269151 | Due to insufficient input sanitization, SAP NetWeaver AS ABAP (BSP Framework) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an unauthenticated user to alter the c… Baharu | NetWeaver AS ABAP | Sederhana | 6.1 | CVE-2023-24521 |
| 3271227 | An unauthenticated attacker in AP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, can craft a link which when … Baharu | NetWeaver Application Server for ABAP and ABAP Platform | Sederhana | 6.1 | CVE-2023-23853 |
| 3274585 | SAP NetWeaver AS ABAP (BSP Framework) application - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allow an unauthenticated attacker to inject the code that can be executed… Baharu | NetWeaver AS ABAP | Sederhana | 6.1 | CVE-2023-25614 |
| 3282663 | Due to lack of proper input validation, BSP application (CRM_BSP_FRAME) - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G, 75H, allow malicious inputs from untrusted sources,… Baharu | NetWeaver AS ABAP | Sederhana | 6.1 | CVE-2023-24529 |
| 3293786 | Due to insufficient input validation, SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an unauthenticated attacker to send a crafte… Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Sederhana | 6.1 | CVE-2023-23858 |
| 3275841 | SAP Business Planning and Consolidation - versions 200, 300, allows an attacker with business authorization to upload any files (including web pages) without the proper file format validation. Baharu | Business Planning and Consolidation | Sederhana | 5.4 | CVE-2023-23851 |
| 2788178 | SAP CRM WebClient UI - versions WEBCUIF 748, 800, 801, S4FND 102, 103, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Baharu | CRM | Sederhana | 4.3 | CVE-2023-24525 |
| 3263863 | In SAP BusinessObjects Business Intelligence (Web Intelligence user interface) - version 430, some calls return json with wrong content type in the header of the response. Baharu | SAP BusinessObjects BI Platform | Sederhana | 4.3 | CVE-2023-23856 |
| 3287291 | SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, does not perform necessary authorization checks for an authenticated user, resulting in … Baharu | NetWeaver AS ABAP and ABAP Platform | Rendah | 3.8 | CVE-2023-23854 |