SAP Security Patch Day: October 2023
Released October 10, 2023 · 7 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for October 10, 2023 (second Tuesday)
- SAP notes
- 7
- Critical
- 0
- High
- 0
- Highest CVSS
- 6.8
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
7 notes with SAP CVEs. 0 Critical and 0 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 6.8.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
No Critical, High, or known-exploited notes this month.
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 7 of 7
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3372991 | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Web Intelligence New | SAP BusinessObjects Web Intelligence | Medium | 6.8 | CVE-2023-42474 |
| 3333426 | Server-Side Request Forgery in SAP NetWeaver AS Java (GRMG Heartbeat application) New | SAP NetWeaver AS Java | Medium | 6.5 | CVE-2023-42477 |
| 3357154 | Missing XML Validation vulnerability in SAP PowerDesigner Client BPMN2 import New | SAP PowerDesigner Client | Medium | 6.5 | CVE-2023-40310 |
| 3326769 | Clickjacking vulnerability in SAP Enable Now NewPublished outside Patch Day | SAP Enable Now | Medium | 6.1 | CVE-2023-36920 |
| 3219846 | Missing Authorization Check In S/4HANA (Manage Withholding Tax Items) New | SAP S/4HANA | Medium | 5.4 | CVE-2023-42473 |
| 3222121 | Information Disclosure Vulnerability in Statutory Reporting New | SAP S/4HANA Core | Medium | 4.3 | CVE-2023-42475 |
| 3338380 | Information Disclosure vulnerability in SAP Business One (B1i) New | SAP Business One | Medium | 4.3 | CVE-2023-41365 |