SAP Security Patch Day: January 2023
Released January 10, 2023 · 9 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for January 10, 2023 (second Tuesday)
- SAP notes
- 9
- Critical
- 5
- High
- 0
- Highest CVSS
- 10.0
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
9 notes with SAP CVEs. 5 Critical and 0 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 10.0.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Central management console)
Code Injection vulnerability in SAP BusinessObjects Business Intelligence platform (Analysis edition for OLAP)
SQL Injection vulnerability in SAP Business Planning and Consolidation MS
Improper access control in SAP NetWeaver AS for Java
Capture-replay vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 9 of 9
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3266006 | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Central management console) New | BusinessObjects Business Intelligence Platform | Critical | 10.0 | CVE-2023-0018 |
| 3262810 | Code Injection vulnerability in SAP BusinessObjects Business Intelligence platform (Analysis edition for OLAP) New | BusinessObjects Business Intelligence platform | Critical | 9.9 | CVE-2023-0022 |
| 3275391 | SQL Injection vulnerability in SAP Business Planning and Consolidation MS New | SAP BPC MS 10.0 | Critical | 9.9 | CVE-2023-0016 |
| 3268093 | Improper access control in SAP NetWeaver AS for Java New | SAP NetWeaver AS Java | Critical | 9.4 | CVE-2023-0017 |
| 3089413 | Capture-replay vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform New | NetWeaver ABAP Server and ABAP Platform | Critical | 9.0 | CVE-2023-0014 |
| 3276120 | Local Privilege Escalation in SAP Host Agent (Windows) New | Host Agent | Medium | 6.4 | CVE-2023-0012 |
| 3283283 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform New | NetWeaver AS for ABAP and ABAP Platform | Medium | 6.1 | CVE-2023-0013 |
| 3251447 | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence (Web Intelligence) New | SAP BusinessObjects BI Platform | Medium | 4.6 | CVE-2023-0015 |
| 3150704 | Information Disclosure in SAP Bank Account Management (Manage Banks) New | Bank Account Management | Medium | 4.5 | CVE-2023-0023 |