SAP Security Notes - 02/23 - SecurityBridge Cloud

We've created the first of its kind, SecurityBridge Cloud Platform, designed to prioritize SAP patches, updates, and remediation strategies that help prevent disruptions to critical business systems. Our security advisories provide SAP users with valuable insights into the security and business implications of operating SAP.

The user interface is designed to be as intuitive as possible, but we’d love to hear your feedback and suggestions.
We hope you enjoy using it!

× Hey there! Glad you made it.
We have found 21 security advices for you to review.

Severity

SAP© Security advisories 21

System Types

Affected SAP© system types

_{Related note}
3285757

_CVSS
8.8

_{Affected system
type}
SAP Host Agent

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-24523] Privilege Escalation vulnerability in SAP Host Agent (Start Service)

Security Advisory

_{Related note}
3263135

_CVSS
8.5

_{Affected system
type}
BI/BO platform

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-0020] Information disclosure vulnerability in SAP BusinessObjects Business Intelligence platform

Security Advisory

_{Related note}
3256787

_CVSS
8.4

_{Affected system
type}
BI/BO platform

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-24530] Unrestricted Upload of File in SAP BusinessObjects Business Intelligence Platform (CMC)

Security Advisory

_{Related note}
3265846

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-0024] Cross Site Scripting in SAP Solution Manager (BSP Application)

Security Advisory

_{Related note}
3281724

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-0019] Missing Authorization check in SAP GRC (Process Control)

Security Advisory

_{Related note}
3290901

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-24528] Missing Authorization Check in SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests)

Security Advisory

_{Related note}
3270509

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-23855] URL Redirection vulnerability in SAP Solution Manager

Security Advisory

_{Related note}
2985905

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-24524] Missing Authorization check in SAP S/4 HANA Map Treasury Correspondence Format Data

Security Advisory

_{Related note}
3267442

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-0025] Cross Site Scripting in SAP Solution Manager (BSP Application)

Security Advisory

_{Related note}
3271227

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-23853] URL Redirection vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

Security Advisory

_{Related note}
3268959

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[Multiple CVEs] Multiple vulnerabilities in SAP NetWeaver AS for ABAP and ABAP Platform

Security Advisory

_{Related note}
3269151

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-24521] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (BSP Framework)

Security Advisory

_{Related note}
3269118

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-24522] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (BSP Framework)

Security Advisory

_{Related note}
3274585

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-25614] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (BSP Framework)

Security Advisory

_{Related note}
3293786

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-23858] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

Security Advisory

_{Related note}
3266751

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-23852] Cross-Site Scripting (XSS) vulnerability in SAP Solution Manager 7.2

Security Advisory

_{Related note}
3282663

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-24529] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (Business Server Pages application)

Security Advisory

_{Related note}
3275841

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-23851] Unrestricted File Upload in SAP Business Planning and Consolidation

Security Advisory

_{Related note}
3263863

_CVSS
4.3

_{Affected system
type}
BI/BO platform

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-23856] Cross-Site Scripting (XSS) vulnerability in Web Intelligence Interface

Security Advisory

_{Related note}
2788178

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-24525] Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI

Security Advisory

_{Related note}
3287291

_CVSS
3.8

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-23854] Missing Authorization check in SAP NetWeaver AS ABAP and ABAP Platform

Security Advisory

Notifications

Severity

SAP© Security advisories 21

System Types

Affected SAP© system types

Related note 3285757

CVSS 8.8

Affected system type SAP Host Agent

Patchday2023-02

Released on2023/02/14

Related note 3263135

CVSS 8.5

Affected system type BI/BO platform

Patchday2023-02

Released on2023/02/14

Related note 3256787

CVSS 8.4

Affected system type BI/BO platform

Patchday2023-02

Released on2023/02/14

Related note 3265846

CVSS 6.5

Affected system type ABAP

Patchday2023-02

Released on2023/02/14

Related note 3281724

CVSS 6.5

Affected system type ABAP

Patchday2023-02

Released on2023/02/14

Related note 3290901

CVSS 6.5

Affected system type ABAP

Patchday2023-02

Released on2023/02/14

Related note 3270509

CVSS 6.5

Affected system type ABAP

Patchday2023-02

Released on2023/02/14

Related note 2985905

CVSS 6.5

Affected system type ABAP

Patchday2023-02

Released on2023/02/14

Related note 3267442

CVSS 6.5

Affected system type ABAP

Patchday2023-02

Released on2023/02/14

Related note 3271227

CVSS 6.1

Affected system type ABAP

Patchday2023-02

Released on2023/02/14

Related note 3268959

CVSS 6.1

Affected system type ABAP

Patchday2023-02

Released on2023/02/14

Related note 3269151

CVSS 6.1

Affected system type ABAP

Patchday2023-02

Released on2023/02/14

Related note 3269118

CVSS 6.1

Affected system type ABAP

Patchday2023-02

Released on2023/02/14

Related note 3274585

CVSS 6.1

Affected system type ABAP

Patchday2023-02

Released on2023/02/14

Related note 3293786

CVSS 6.1

Affected system type ABAP

Patchday2023-02

Released on2023/02/14

_{Related note}
3285757

_CVSS
8.8

_{Affected system
type}
SAP Host Agent

_Patchday
2023-02

_{Released
on}
2023/02/14

_{Related note}
3263135

_CVSS
8.5

_{Affected system
type}
BI/BO platform

_Patchday
2023-02

_{Released
on}
2023/02/14

_{Related note}
3256787

_CVSS
8.4

_{Affected system
type}
BI/BO platform

_Patchday
2023-02

_{Released
on}
2023/02/14

_{Related note}
3265846

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

_{Related note}
3281724

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

_{Related note}
3290901

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

_{Related note}
3270509

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

_{Related note}
2985905

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

_{Related note}
3267442

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

_{Related note}
3271227

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

_{Related note}
3268959

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

_{Related note}
3269151

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

_{Related note}
3269118

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

_{Related note}
3274585

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

_{Related note}
3293786

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

_{Related note}
3266751

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14