Diterjemahkan oleh mesin; mungkin terdapat kesilapan. (Machine-translated; may contain errors.) Baca versi bahasa Inggeris (Read in English)
Hari Tampalan Keselamatan SAP: April 2023
Diterbitkan pada 11 April 2023 · 18 nota · Sumber: rekod CVE di CVE.org (SAP sebagai CNA)
Dijadualkan pada 11 April 2023 (Selasa kedua)
- Nota SAP
- 18
- Kritikal
- 2
- Tinggi
- 1
- CVSS tertinggi
- 10.0
- Diketahui dieksploitasi
- 0
Keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP: CVSS 9.0 atau lebih ialah Kritikal, 7.0 atau lebih Tinggi, 4.0 atau lebih Sederhana, bawah 4.0 Rendah. Keutamaan SAP sendiri hanya terdapat di SAP for Me (log masuk SAP diperlukan).
Ringkasan kami
18 nota dengan CVE SAP. 2 Kritikal dan 1 Tinggi (keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP). CVSS tertinggi 10.0.
Tampalan yang perlu didahulukan
Disusun mengikut: eksploitasi yang diketahui (CISA KEV), kemudian keutamaan (diterbitkan daripada CVSS, bukan keutamaan SAP), kemudian CVSS. Ini alat bantu triaj, bukan pengganti penilaian risiko anda sendiri.
Multiple vulnerabilities in SAP Diagnostics Agent (EventLogServiceCollector)
Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management)
Directory/Path Traversal vulnerability in SAP NetWeaver.
Perlukan triaj nota bulan ini untuk landskap anda sendiri? Khidmat keselamatan SAP (digitaldisciple.dev)
Semua nota
Keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP: CVSS 9.0 atau lebih ialah Kritikal, 7.0 atau lebih Tinggi, 4.0 atau lebih Sederhana, bawah 4.0 Rendah. Keutamaan SAP sendiri hanya terdapat di SAP for Me (log masuk SAP diperlukan).
Liputan: laman ini disusun daripada rekod CVE SAP, jadi nota tanpa CVE, nota yang hanya mempunyai CVE pihak ketiga (contohnya Apache atau OpenSSL), dan kemas kini kepada nota terdahulu tidak diliputi. Jumlahnya kira-kira 7% daripada nota baharu.
Memaparkan 18 daripada 18
| Tajuk | CVE | ||||
|---|---|---|---|---|---|
| 3305369 | Multiple vulnerabilities in SAP Diagnostics Agent (EventLogServiceCollector) Baharu | Diagnostics Agent | Kritikal | 10.0 | CVE-2023-27267, CVE-2023-27497 |
| 3298961 | Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management) Baharu | BusinessObjects Business Intelligence Platform | Kritikal | 9.8 | CVE-2023-28765 |
| 3305907 | Directory/Path Traversal vulnerability in SAP NetWeaver. Baharu | NetWeaver | Tinggi | 8.7 | CVE-2023-29186 |
| 3312733 | Information Disclosure vulnerability in SAP Landscape Management Baharu | Landscape Management | Sederhana | 6.8 | CVE-2023-26458 |
| 3311624 | DLL Hijacking vulnerability in SapSetup (Software Installation Program) Baharu | SapSetup | Sederhana | 6.7 | CVE-2023-29187 |
| 3289994 | Missing Authentication check in SAP NetWeaver Enterprise Portal Baharu | NetWeaver Enterprise Portal | Sederhana | 6.5 | CVE-2023-28761 |
| 3296378 | Denial of Service in SAP NetWeaver AS for ABAP and ABAP Platform Baharu | NetWeaver AS for ABAP and ABAP Platform | Sederhana | 6.5 | CVE-2023-28763 |
| 3275458 | Cross-Site Scripting (XSS) vulnerability in SAP GUI for HTML Baharu | GUI for HTML | Sederhana | 6.1 | CVE-2023-27499 |
| 3309056 | Code Injection vulnerability in SAP CRM Baharu | CRM | Sederhana | 6.0 | CVE-2023-27897 |
| 3269352 | HTTP Verb Tampering vulnerability in SAP CRM (WebClient UI) Baharu | CRM | Sederhana | 5.4 | CVE-2023-29189 |
| 3287784 | Improper Access Control in SAP NetWeaver AS Java for Deploy Service Baharu | NetWeaver AS Java for Deploy Service | Sederhana | 5.3 | CVE-2023-24527 |
| 3303060 | Denial of Service (DOS) in SAP NetWeaver AS for ABAP (Business Server Pages) Baharu | NetWeaver AS for ABAP | Sederhana | 5.3 | CVE-2023-29185 |
| 3315312 | IP filter vulnerability in ABAP Platform and SAP Web Dispatcher Baharu | ABAP Platform and SAP Web Dispatcher | Sederhana | 5.0 | CVE-2023-29108 |
| 3115598 | Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard) Baharu | Application Interface Framework | Sederhana | 4.4 | CVE-2023-29109 |
| 3301457 | Missing Authorization check in SAP HCM Fiori App My Forms (Fiori 2.0) Baharu | HCM Fiori App My Forms | Sederhana | 4.3 | CVE-2023-1903 |
| 3113349 | Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard) Baharu | Application Interface Framework | Rendah | 3.7 | CVE-2023-29110 |
| 3114489 | Code Injection vulnerability in SAP Application Interface Framework (Message Monitoring) Baharu | Application Interface Framework | Rendah | 3.7 | CVE-2023-29112 |
| 3117978 | Information Disclosure vulnerability in SAP Application Interface Framework (ODATA service) Baharu | Application Interface Framework | Rendah | 3.1 | CVE-2023-29111 |