SAP Security Patch Day: December 2023
Released December 12, 2023 · 12 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for December 12, 2023 (second Tuesday)
- SAP notes
- 12
- Critical
- 1
- High
- 4
- Highest CVSS
- 9.1
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
12 notes with SAP CVEs. 1 Critical and 4 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 9.1.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Escalation of Privileges in SAP BTP Security Services Integration Library ([Node.js] @sap/xssec)
Improper Access Control vulnerability in SAP Commerce Cloud
Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform
Information disclosure in SAP GUI for Windows and SAP GUI for Java
Improper Export of Android Application Components in SAP EMARSYS SDK ANDROID
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 12 of 12
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3411067 | Escalation of Privileges in SAP BTP Security Services Integration Library ([Node.js] @sap/xssec) New | @sap/xssec | Critical | 9.1 | CVE-2023-49583, CVE-2023-50422, CVE-2023-50423, CVE-2023-50424 |
| 3394567 | Improper Access Control vulnerability in SAP Commerce Cloud New | SAP Commerce Cloud | High | 8.1 | CVE-2023-42481 |
| 3382353 | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform New | Business Objects BI Platform | High | 7.5 | CVE-2023-42476, CVE-2023-42478 |
| 3385711 | Information disclosure in SAP GUI for Windows and SAP GUI for Java New | SAP GUI for Windows and SAP GUI for Java | High | 7.3 | CVE-2023-49580 |
| 3406244 | Improper Export of Android Application Components in SAP EMARSYS SDK ANDROID New | SAP EMARSYS SDK ANDROID | High | 7.1 | CVE-2023-6542 |
| 3395306 | Command Injection vulnerability in SAP Solution Manager New | SAP Solution Manager | Medium | 6.4 | CVE-2023-49587 |
| 3217087 | Cross-Site Scripting (XSS) vulnerability in the SAP HCM (SMART PAYE solution) New | SAP HCM | Medium | 6.1 | CVE-2023-49577 |
| 3383321 | Cross-Site Scripting (XSS) vulnerability in SAP Biller Direct New | SAP Biller Direct | Medium | 6.1 | CVE-2023-42479 |
| 3406786 | Client-Side Desynchronization vulnerability in SAP Fiori Launchpad New | SAP Fiori Launchpad | Medium | 4.3 | CVE-2023-49584 |
| 3392547 | SQL Injection vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.1 | CVE-2023-49581 |
| 3362463 | Denial of service (DOS) in SAP Cloud Connector New | SAP Cloud Connector | Low | 3.5 | CVE-2023-49578 |
| 3363690 | Directory Traversal vulnerability in SAP Master Data Governance New | SAP Master Data Governance | Low | 3.5 | CVE-2023-49058 |