SAP Security Patch Day: May 2023
Released May 9, 2023 · 14 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for May 9, 2023 (second Tuesday)
- SAP notes
- 14
- Critical
- 1
- High
- 4
- Highest CVSS
- 9.1
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
14 notes with SAP CVEs. 1 Critical and 4 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 9.1.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Information Disclosure in SAP BusinessObjects Intelligence Platform
Improper access control during application start-up in SAP AS NetWeaver JAVA.
Memory Corruption vulnerability in SAP PowerDesigner (Proxy)
Information Disclosure vulnerability in SAP GUI for Windows
Improper Neutralization of Input in SAPUI5
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 14 of 14
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3307833 | Information Disclosure in SAP BusinessObjects Intelligence Platform New | SAP BusinessObjects BI Platform | Critical | 9.1 | CVE-2023-28762 |
| 3317453 | Improper access control during application start-up in SAP AS NetWeaver JAVA. New | SAP AS NetWeaver JAVA | High | 8.2 | CVE-2023-30744 |
| 3300624 | Memory Corruption vulnerability in SAP PowerDesigner (Proxy) New | SAP PowerDesigner | High | 7.5 | CVE-2023-32111 |
| 3320467 | Information Disclosure vulnerability in SAP GUI for Windows New | SAP GUI for Windows | High | 7.5 | CVE-2023-32113 |
| 3326210 | Improper Neutralization of Input in SAPUI5 New | SAPUI5 | High | 7.1 | CVE-2023-30743 |
| 3313484 | Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Medium | 6.3 | CVE-2023-30740 |
| 3309935 | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Medium | 6.1 | CVE-2023-30741 |
| 3315971 | Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI) New | SAP CRM | Medium | 6.1 | CVE-2023-30742 |
| 3319400 | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Medium | 6.1 | CVE-2023-31406 |
| 3312892 | Cross-Site Scripting (XSS) vulnerability in SAP Business Planning and Consolidation New | SAP Business Planning and Consolidation | Medium | 5.4 | CVE-2023-31407 |
| 3315979 | Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI New | SAP CRM WebClient UI | Medium | 5.4 | CVE-2023-29188 |
| 3038911 | Information Disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Service) New | SAP BusinessObjects BI Platform | Medium | 5.0 | CVE-2023-31404 |
| 3302595 | Information Disclosure vulnerability in SAP BusinessObjects Platform New | SAP BusinessObjects BI Platform | Low | 3.7 | CVE-2023-28764 |
| 2335198 | Missing Authorization Check in Vendor Master Hierarchy New | Vendor Master Hierarchy | Low | 2.8 | CVE-2023-32112 |