SAP Security Patch Day: September 2023
Released September 12, 2023 · 13 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for September 12, 2023 (second Tuesday)
- SAP notes
- 12
- GitHub advisories
- 1
- Critical
- 2
- High
- 2
- Highest CVSS
- 9.9
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
13 notes with SAP CVEs. 2 Critical and 2 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 9.9.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management)
Missing Authorization check in SAP CommonCryptoLib
Insufficient File type validation in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)
Memory Corruption vulnerability in SAP CommonCryptoLib
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 13 of 13
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3320355 | Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management) New | SAP BusinessObjects BI Platform | Critical | 9.9 | CVE-2023-40622 |
| 3340576 | Missing Authorization check in SAP CommonCryptoLib New | SAP CommonCryptoLib | Critical | 9.8 | CVE-2023-40309 |
| 3370490 | Insufficient File type validation in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) New | SAP BusinessObjects BI Platform | High | 8.7 | CVE-2023-42472 |
| 3327896 | Memory Corruption vulnerability in SAP CommonCryptoLib New | SAP CommonCryptoLib | High | 7.5 | CVE-2023-40308 |
| 3357163 | Code Injection vulnerability in SAP PowerDesigner Client New | SAP PowerDesigner Client | Medium | 6.3 | CVE-2023-40621 |
| GHSA-rgq4-wxpj-5jv9 | Privileges Memory Corruption (Out-of-bound write) NewPublished outside Patch Day | SAP Privileges | Medium | 6.3 | CVE-2023-40307 |
| 3317702 | Arbitrary File Delete via Directory Junction in SAP BusinessObjects Suite(installer) New | SAP BusinessObjects Suite | Medium | 6.2 | CVE-2023-40623 |
| 3323163 | Code Injection vulnerability in SAP NetWeaver AS ABAP (applications based on Unified Rendering) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 5.5 | CVE-2023-40624 |
| 3326361 | Missing Authorization check in SAP Manage Purchase Contracts App New | SAP Manage Purchase Contracts App | Medium | 5.4 | CVE-2023-40625 |
| 3348142 | Missing Authentication check in SAP NetWeaver (Guided Procedures) New | SAP NetWeaver | Medium | 5.3 | CVE-2023-41367 |
| 3352453 | Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Version Management System) New | SAP BusinessObjects BI Platform | Medium | 5.3 | CVE-2023-37489 |
| 3369680 | External Entity Loop vulnerability in SAP S/4HANA (Create Single Payment application) New | SAP S/4HANA | Low | 3.5 | CVE-2023-41369 |
| 3355675 | Insecure Direct Object Reference (IDOR) vulnerability in S4 HANA (Manage checkbook apps) New | S4 HANA ABAP | Low | 2.7 | CVE-2023-41368 |