SAP Security Patch Day: July 2023
Released July 11, 2023 · 16 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for July 11, 2023 (second Tuesday)
- SAP notes
- 16
- Critical
- 1
- High
- 6
- Highest CVSS
- 9.1
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
16 notes with SAP CVEs. 1 Critical and 6 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 9.1.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL)
Directory Traversal vulnerability in SAP NetWeaver (BI CONT ADD ON)
Request smuggling and request concatenation in SAP Web Dispatcher
Denial of Service (DoS) vulnerability in SAP SQL Anywhere
Memory Corruption vulnerability in SAP Web Dispatcher
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 16 of 16
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3350297 | OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL) New | SAP ECC and SAP S/4HANA | Critical | 9.1 | CVE-2023-36922 |
| 3331376 | Directory Traversal vulnerability in SAP NetWeaver (BI CONT ADD ON) New | SAP NetWeaver | High | 8.7 | CVE-2023-33989 |
| 3233899 | Request smuggling and request concatenation in SAP Web Dispatcher New | SAP Web Dispatcher | High | 8.6 | CVE-2023-33987 |
| 3331029 | Denial of Service (DoS) vulnerability in SAP SQL Anywhere New | SAP SQL Anywhere | High | 7.8 | CVE-2023-33990 |
| 3340735 | Memory Corruption vulnerability in SAP Web Dispatcher New | SAP Web Dispatcher | High | 7.7 | CVE-2023-35871 |
| 3348145 | Header Injection in SAP Solution Manager (Diagnostic Agent) New | SAP Solution Manager | High | 7.2 | CVE-2023-36921 |
| 3352058 | Unauthenticated blind SSRF in SAP Solution Manager (Diagnostics agent) New | SAP Solution Manager | High | 7.2 | CVE-2023-36925 |
| 3343547 | Missing Authentication check in SAP NetWeaver Process Integration (Runtime Workbench) New | SAP NetWeaver Process Integration | Medium | 6.5 | CVE-2023-35873 |
| 3343564 | Missing Authentication check in SAP NetWeaver Process Integration (Message Display Tool) New | SAP NetWeaver Process Integration | Medium | 6.5 | CVE-2023-35872 |
| 3341211 | Improper Access Control in SAP S/4HANA (Manage Journal Entry Template) New | SAP S/4HANA | Medium | 6.3 | CVE-2023-35870 |
| 3326769 | Cross-Site Scripting vulnerability in SAP Enable Now New | SAP Enable Now | Medium | 6.1 | CVE-2023-33988, CVE-2023-36918, CVE-2023-36919 |
| 3318850 | Improper authentication vulnerability in SAP NetWeaver AS ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.0 | CVE-2023-35874 |
| 3320702 | Password Change rate limit bypass in SAP BusinessObjects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Medium | 5.9 | CVE-2023-36917 |
| 3324732 | Log Injection vulnerability in SAP NetWeaver AS for Java (Log Viewer) New | SAP NetWeaver AS Java | Medium | 5.3 | CVE-2023-31405 |
| 3351410 | Log Injection vulnerability in SAP ERP Defense Forces and Public Security New | SAP ERP Defense Forces and Public Security | Medium | 4.9 | CVE-2023-36924 |
| 3088078 | Missing Authorization Check in SAP Business Warehouse and SAP BW/4HANA New | SAP Business Warehouse and SAP BW/4HANA | Medium | 4.5 | CVE-2023-33992 |