SAP Security Patch Day: June 2023
Released June 13, 2023 · 7 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for June 13, 2023 (second Tuesday)
- SAP notes
- 7
- Critical
- 0
- High
- 2
- Highest CVSS
- 8.2
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
7 notes with SAP CVEs. 0 Critical and 2 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 8.2.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Stored Cross-Site Scripting (Stored XSS) vulnerability in SAP UI5 Variant Management
Missing Authentication in SAP Plant Connectivity and Production Connector for SAP Digital
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 7 of 7
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3324285 | Stored Cross-Site Scripting (Stored XSS) vulnerability in SAP UI5 Variant Management New | SAP UI5 Variant Management | High | 8.2 | CVE-2023-33991 |
| 3301942 | Missing Authentication in SAP Plant Connectivity and Production Connector for SAP Digital New | SAP Plant Connectivity | High | 7.9 | CVE-2023-2827 |
| 3318657 | Cross-Site Scripting (XSS) vulnerability in NetWeaver (Design Time Repository) New | SAP NetWeaver | Medium | 6.4 | CVE-2023-33984 |
| 2826092 | Cross-Site Scripting (XSS) vulnerability in SAP CRM ABAP (Grantor Management) New | SAP CRM ABAP | Medium | 6.1 | CVE-2023-33986 |
| 3331627 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal New | SAP NetWeaver Enterprise Portal | Medium | 6.1 | CVE-2023-33985 |
| 1794761 | SQL Injection in Master Data Synchronization (MDS COMPARE TOOL) New | Master Data Synchronization | Medium | 4.2 | CVE-2023-32115 |
| 3325642 | Denial of Service in SAP NetWeaver New | SAP NetWeaver | Low | 2.7 | CVE-2023-32114 |