SAP Security Patch Day: April 2023
Released April 11, 2023 · 18 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for April 11, 2023 (second Tuesday)
- SAP notes
- 18
- Critical
- 2
- High
- 1
- Highest CVSS
- 10.0
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
18 notes with SAP CVEs. 2 Critical and 1 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 10.0.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Multiple vulnerabilities in SAP Diagnostics Agent (EventLogServiceCollector)
Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management)
Directory/Path Traversal vulnerability in SAP NetWeaver.
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 18 of 18
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3305369 | Multiple vulnerabilities in SAP Diagnostics Agent (EventLogServiceCollector) New | Diagnostics Agent | Critical | 10.0 | CVE-2023-27267, CVE-2023-27497 |
| 3298961 | Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management) New | BusinessObjects Business Intelligence Platform | Critical | 9.8 | CVE-2023-28765 |
| 3305907 | Directory/Path Traversal vulnerability in SAP NetWeaver. New | NetWeaver | High | 8.7 | CVE-2023-29186 |
| 3312733 | Information Disclosure vulnerability in SAP Landscape Management New | Landscape Management | Medium | 6.8 | CVE-2023-26458 |
| 3311624 | DLL Hijacking vulnerability in SapSetup (Software Installation Program) New | SapSetup | Medium | 6.7 | CVE-2023-29187 |
| 3289994 | Missing Authentication check in SAP NetWeaver Enterprise Portal New | NetWeaver Enterprise Portal | Medium | 6.5 | CVE-2023-28761 |
| 3296378 | Denial of Service in SAP NetWeaver AS for ABAP and ABAP Platform New | NetWeaver AS for ABAP and ABAP Platform | Medium | 6.5 | CVE-2023-28763 |
| 3275458 | Cross-Site Scripting (XSS) vulnerability in SAP GUI for HTML New | GUI for HTML | Medium | 6.1 | CVE-2023-27499 |
| 3309056 | Code Injection vulnerability in SAP CRM New | CRM | Medium | 6.0 | CVE-2023-27897 |
| 3269352 | HTTP Verb Tampering vulnerability in SAP CRM (WebClient UI) New | CRM | Medium | 5.4 | CVE-2023-29189 |
| 3287784 | Improper Access Control in SAP NetWeaver AS Java for Deploy Service New | NetWeaver AS Java for Deploy Service | Medium | 5.3 | CVE-2023-24527 |
| 3303060 | Denial of Service (DOS) in SAP NetWeaver AS for ABAP (Business Server Pages) New | NetWeaver AS for ABAP | Medium | 5.3 | CVE-2023-29185 |
| 3315312 | IP filter vulnerability in ABAP Platform and SAP Web Dispatcher New | ABAP Platform and SAP Web Dispatcher | Medium | 5.0 | CVE-2023-29108 |
| 3115598 | Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard) New | Application Interface Framework | Medium | 4.4 | CVE-2023-29109 |
| 3301457 | Missing Authorization check in SAP HCM Fiori App My Forms (Fiori 2.0) New | HCM Fiori App My Forms | Medium | 4.3 | CVE-2023-1903 |
| 3113349 | Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard) New | Application Interface Framework | Low | 3.7 | CVE-2023-29110 |
| 3114489 | Code Injection vulnerability in SAP Application Interface Framework (Message Monitoring) New | Application Interface Framework | Low | 3.7 | CVE-2023-29112 |
| 3117978 | Information Disclosure vulnerability in SAP Application Interface Framework (ODATA service) New | Application Interface Framework | Low | 3.1 | CVE-2023-29111 |