Diterjemahkan oleh mesin; mungkin terdapat kesilapan. (Machine-translated; may contain errors.) Baca versi bahasa Inggeris (Read in English)
Hari Tampalan Keselamatan SAP: Mac 2023
Diterbitkan pada 14 Mac 2023 · 19 nota · Sumber: rekod CVE di CVE.org (SAP sebagai CNA)
Dijadualkan pada 14 Mac 2023 (Selasa kedua)
- Nota SAP
- 19
- Kritikal
- 5
- Tinggi
- 4
- CVSS tertinggi
- 9.9
- Diketahui dieksploitasi
- 0
Keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP: CVSS 9.0 atau lebih ialah Kritikal, 7.0 atau lebih Tinggi, 4.0 atau lebih Sederhana, bawah 4.0 Rendah. Keutamaan SAP sendiri hanya terdapat di SAP for Me (log masuk SAP diperlukan).
Ringkasan kami
19 nota dengan CVE SAP. 5 Kritikal dan 4 Tinggi (keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP). CVSS tertinggi 9.9.
Tampalan yang perlu didahulukan
Disusun mengikut: eksploitasi yang diketahui (CISA KEV), kemudian keutamaan (diterbitkan daripada CVSS, bukan keutamaan SAP), kemudian CVSS. Ini alat bantu triaj, bukan pengganti penilaian risiko anda sendiri.
Code Injection vulnerability in SAP Business Objects Business Intelligence Platform (CMC)
Improper Access Control in SAP NetWeaver AS for Java
Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
OS Command Execution vulnerability in SAP Business Objects Business Intelligence Platform (Adaptive Job Server)
Perlukan triaj nota bulan ini untuk landskap anda sendiri? Khidmat keselamatan SAP (digitaldisciple.dev)
Semua nota
Keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP: CVSS 9.0 atau lebih ialah Kritikal, 7.0 atau lebih Tinggi, 4.0 atau lebih Sederhana, bawah 4.0 Rendah. Keutamaan SAP sendiri hanya terdapat di SAP for Me (log masuk SAP diperlukan).
Liputan: laman ini disusun daripada rekod CVE SAP, jadi nota tanpa CVE, nota yang hanya mempunyai CVE pihak ketiga (contohnya Apache atau OpenSSL), dan kemas kini kepada nota terdahulu tidak diliputi. Jumlahnya kira-kira 7% daripada nota baharu.
Memaparkan 19 daripada 19
| Tajuk | CVE | ||||
|---|---|---|---|---|---|
| 3245526 | Code Injection vulnerability in SAP Business Objects Business Intelligence Platform (CMC) Baharu | Business Objects Business Intelligence Platform | Kritikal | 9.9 | CVE-2023-25616 |
| 3252433 | Improper Access Control in SAP NetWeaver AS for Java Baharu | SAP NetWeaver AS Java | Kritikal | 9.9 | CVE-2023-23857 |
| 3294595 | Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform Baharu | NetWeaver Application Server for ABAP and ABAP Platform | Kritikal | 9.6 | CVE-2023-27269 |
| 3302162 | Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform Baharu | NetWeaver AS for ABAP and ABAP Platform | Kritikal | 9.6 | CVE-2023-27500 |
| 3283438 | OS Command Execution vulnerability in SAP Business Objects Business Intelligence Platform (Adaptive Job Server) Baharu | Business Objects | Kritikal | 9.0 | CVE-2023-25617 |
| 3296476 | Arbitrary Code Execution in SAP Solution Manager and ABAP managed systems (ST-PI) Baharu | Solution Manager and ABAP managed systems | Tinggi | 8.8 | CVE-2023-27893 |
| 3294954 | Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform Baharu | NetWeaver AS for ABAP and ABAP Platform | Tinggi | 8.7 | CVE-2023-27501 |
| 3296346 | Server Side Request Forgery (SSRF) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform Baharu | NetWeaver AS for ABAP and ABAP Platform | Tinggi | 7.4 | CVE-2023-25618, CVE-2023-26459 |
| 3275727 | Memory Corruption vulnerability in SAP Host Agent (SAPOSCOL) Baharu | Host Agent | Tinggi | 7.2 | CVE-2023-27498 |
| 3284550 | XML External Entity (XXE) vulnerability in SAP NetWeaver (SAP Enterprise Portal) Baharu | NetWeaver | Sederhana | 6.8 | CVE-2023-26461 |
| 3289844 | SQL Injection vulnerability in SAP ABAP Platform Baharu | ABAP Platform | Sederhana | 6.8 | CVE-2023-25615 |
| 3287120 | Server Side Request Forgery (SSRF) in the SAP BusinessObjects Business Intelligence platform Baharu | BusinessObjects Business Intelligence Platform | Sederhana | 6.5 | CVE-2023-27271, CVE-2023-27894, CVE-2023-27896 |
| 3296328 | Denial of Service (DoS) in SAP NetWeaver AS for ABAP and ABAP Platform Baharu | NetWeaver Application Server for ABAP and ABAP Platform | Sederhana | 6.5 | CVE-2023-27270 |
| 3274920 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Baharu | SAP NetWeaver | Sederhana | 6.1 | CVE-2023-0021 |
| 3281484 | Cross-Site Scripting (XSS) vulnerability in SAP Content Server Baharu | Content Server | Sederhana | 6.1 | CVE-2023-26457 |
| 3302710 | Information Disclosure vulnerability in SAP Authenticator for Android Baharu | Authenticator for Android | Sederhana | 6.1 | CVE-2023-27895 |
| 3288096 | Improper Access Control in SAP NetWeaver AS Java (Cache Management Service) Baharu | SAP NetWeaver AS Java | Sederhana | 5.3 | CVE-2023-26460 |
| 3288394 | Improper Access Control in SAP NetWeaver AS Java (Classload Service) Baharu | NetWeaver AS Java for Classload Service | Sederhana | 5.3 | CVE-2023-24526 |
| 3288480 | Improper Access Control in SAP NetWeaver AS Java (Object Analyzing Service) Baharu | SAP NetWeaver AS Java | Sederhana | 5.3 | CVE-2023-27268 |