SAP Security Patch Day: August 2023
Released August 8, 2023 · 16 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for August 8, 2023 (second Tuesday)
- SAP notes
- 15
- GitHub advisories
- 1
- Critical
- 1
- High
- 6
- Highest CVSS
- 9.8
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
16 notes with SAP CVEs. 1 Critical and 7 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 9.8.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Improper Access Control Vulnerabilities in SAP PowerDesigner
SAP Commerce accepts empty passphrases.
Missing Authorization check allows certain operations on CLA Assistant data
Code Injection vulnerability in SAP PowerDesigner
Binary hijack in SAP BusinessObjects Business Intelligence (Installer)
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 16 of 16
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3341460 | Improper Access Control Vulnerabilities in SAP PowerDesigner New | SAP PowerDesigner | Critical | 9.8 | CVE-2023-37483, CVE-2023-37484 |
| 3346500 | SAP Commerce accepts empty passphrases. New | SAP Commerce Cloud | High | 8.8 | CVE-2023-39439 |
| GHSA-gw8p-frwv-25gh | Missing Authorization check allows certain operations on CLA Assistant data NewPublished outside Patch Day | CLA Assistant | High | 8.1 | CVE-2023-39438 |
| 3341599 | Code Injection vulnerability in SAP PowerDesigner New | SAP PowerDesigner | High | 7.8 | CVE-2023-36923 |
| 3317710 | Binary hijack in SAP BusinessObjects Business Intelligence (Installer) New | SAP BusinessObjects BI Platform | High | 7.6 | CVE-2023-37490 |
| 3358300 | Cross-Site Scripting (XSS) vulnerability in SAP Business One New | SAP Business One | High | 7.6 | CVE-2023-39437 |
| 3344295 | Improper Authorization check vulnerability in SAP Message Server New | SAP Message Server | High | 7.5 | CVE-2023-37491 |
| 3337797 | SQL Injection vulnerability in SAP Business One B1i Layer New | SAP Business One | High | 7.1 | CVE-2023-33993 |
| 3156972 | URL Redirection vulnerability in SAP S/4HANA (Manage Catalog Items and Cross-Catalog search) NewPublished outside Patch Day | SAP S/4HANA | Medium | 6.1 | CVE-2023-40306 |
| 3350494 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Process Integration New | SAP NetWeaver Process Integration | Medium | 6.1 | CVE-2023-37488 |
| 3341934 | Information Disclosure vulnerability in SAP Commerce (OCC API) New | SAP Commerce Cloud | Medium | 5.9 | CVE-2023-37486 |
| 2067220 | Information Disclosure in SAP Supplier Relationship Management New | SAP Supplier Relationship Management | Medium | 5.8 | CVE-2023-39436 |
| 3333616 | Security misconfiguration vulnerability in SAP Business One (Service Layer) New | SAP Business One | Medium | 5.3 | CVE-2023-37487 |
| 3348000 | Missing Authorization check in SAP NetWeaver AS ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.9 | CVE-2023-37492 |
| 3312586 | Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Medium | 4.4 | CVE-2023-39440 |
| 3358328 | Information disclosure vulnerability in SAP Host Agent New | SAP Host Agent | Low | 3.7 | CVE-2023-36926 |