SAP Security Notes - 04/23 - SecurityBridge Cloud

We've created the first of its kind, SecurityBridge Cloud Platform, designed to prioritize SAP patches, updates, and remediation strategies that help prevent disruptions to critical business systems. Our security advisories provide SAP users with valuable insights into the security and business implications of operating SAP.

The user interface is designed to be as intuitive as possible, but we’d love to hear your feedback and suggestions.
We hope you enjoy using it!

× Yikes, there is work to do!
This time we found critical correction advisiories. We count 18 and the highest CVSS score is 10.0.

Severity

SAP© Security advisories 18

System Types

Affected SAP© system types

_{Related note}
3305369

_CVSS
10.0

_{Affected system
type}
Java

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-27497] Multiple vulnerabilities in SAP Diagnostics Agent (OSCommand Bridge and EventLogServiceCollector)

Security Advisory

_{Related note}
3298961

_CVSS
9.8

_{Affected system
type}
BI/BO platform

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-28765] Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management )

Security Advisory

_{Related note}
3305907

_CVSS
8.7

_{Affected system
type}
ABAP

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-29186] Directory Traversal vulnerability in SAP NetWeaver ( BI CONT ADD ON)

Security Advisory

_{Related note}
3312733

_CVSS
6.8

_{Affected system
type}
Java

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-26458] Information Disclosure vulnerability in SAP Landscape Management

Security Advisory

_{Related note}
3311624

_CVSS
6.7

_{Affected system
type}
SAP GUI / Frontend

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-29187] DLL Hijacking vulnerability in SapSetup (Software Installation Program)

Security Advisory

_{Related note}
3289994

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-28761] Missing Authentication check in SAP NetWeaver Enterprise Portal

Security Advisory

_{Related note}
3296378

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-28763] - Denial of Service in SAP NetWeaver AS for ABAP and ABAP Platform

Security Advisory

_{Related note}
3275458

_CVSS
6.1

_{Affected system
type}
Kernel

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-27499] Cross-Site Scripting (XSS) vulnerability in SAP GUI for HTML

Security Advisory

_{Related note}
3309056

_CVSS
6.0

_{Affected system
type}
ABAP

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-27897] Code Injection vulnerability in SAP CRM

Security Advisory

_{Related note}
3269352

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-29189] HTTP Verb Tampering vulnerability in SAP CRM (WebClient UI)

Security Advisory

_{Related note}
3303060

_CVSS
5.3

_{Affected system
type}
ABAP

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-29185] Denial of Service (DOS) in SAP NetWeaver AS for ABAP (Business Server Pages)

Security Advisory

_{Related note}
3315312

_CVSS
5.0

_{Affected system
type}
Kernel

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-29108] IP filter vulnerability in ABAP Platform and SAP Web Dispatcher

Security Advisory

_{Related note}
3316509

_CVSS
4.7

_{Affected system
type}
SAP Commerce

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
Remote Code Execution vulnerability in SAP Commerce

Security Advisory

_{Related note}
3115598

_CVSS
4.4

_{Affected system
type}
ABAP

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-29109] Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard)

Security Advisory

_{Related note}
3301457

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-1903] Missing Authorization check in SAP HCM Fiori App My Forms (Fiori 2.0)

Security Advisory

_{Related note}
3114489

_CVSS
3.7

_{Affected system
type}
ABAP

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-29112] Code Injection vulnerability in SAP Application Interface Framework (Message Monitoring)

Security Advisory

_{Related note}
3113349

_CVSS
3.7

_{Affected system
type}
ABAP

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-29110] Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard)

Security Advisory

_{Related note}
3117978

_CVSS
3.1

_{Affected system
type}
ABAP

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-29111] Information Disclosure vulnerability in SAP Application Interface Framework (ODATA service)

Security Advisory

Notifications

Severity

SAP© Security advisories 18

System Types

Affected SAP© system types

Related note 3305369

CVSS 10.0

Affected system type Java

Patchday2023-04

Released on2023/04/11

Related note 3298961

CVSS 9.8

Affected system type BI/BO platform

Patchday2023-04

Released on2023/04/11

Related note 3305907

CVSS 8.7

Affected system type ABAP

Patchday2023-04

Released on2023/04/11

Related note 3312733

CVSS 6.8

Affected system type Java

Patchday2023-04

Released on2023/04/11

Related note 3311624

CVSS 6.7

Affected system type SAP GUI / Frontend

Patchday2023-04

Released on2023/04/11

Related note 3289994

CVSS 6.5

Affected system type Java

Patchday2023-04

Released on2023/04/11

Related note 3296378

CVSS 6.5

Affected system type ABAP

Patchday2023-04

Released on2023/04/11

Related note 3275458

CVSS 6.1

Affected system type Kernel

Patchday2023-04

Released on2023/04/11

Related note 3309056

CVSS 6.0

Affected system type ABAP

Patchday2023-04

Released on2023/04/11

Related note 3269352

CVSS 5.4

Affected system type ABAP

Patchday2023-04

Released on2023/04/11

Related note 3303060

CVSS 5.3

Affected system type ABAP

Patchday2023-04

Released on2023/04/11

Related note 3315312

CVSS 5.0

Affected system type Kernel

Patchday2023-04

Released on2023/04/11

Related note 3316509

CVSS 4.7

Affected system type SAP Commerce

Patchday2023-04

Released on2023/04/11

Related note 3115598

CVSS 4.4

Affected system type ABAP

Patchday2023-04

Released on2023/04/11

Related note 3301457

CVSS 4.3

Affected system type ABAP

Patchday2023-04

Released on2023/04/11

_{Related note}
3305369

_CVSS
10.0

_{Affected system
type}
Java

_Patchday
2023-04

_{Released
on}
2023/04/11

_{Related note}
3298961

_CVSS
9.8

_{Affected system
type}
BI/BO platform

_Patchday
2023-04

_{Released
on}
2023/04/11

_{Related note}
3305907

_CVSS
8.7

_{Affected system
type}
ABAP

_Patchday
2023-04

_{Released
on}
2023/04/11

_{Related note}
3312733

_CVSS
6.8

_{Affected system
type}
Java

_Patchday
2023-04

_{Released
on}
2023/04/11

_{Related note}
3311624

_CVSS
6.7

_{Affected system
type}
SAP GUI / Frontend

_Patchday
2023-04

_{Released
on}
2023/04/11

_{Related note}
3289994

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2023-04

_{Released
on}
2023/04/11

_{Related note}
3296378

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2023-04

_{Released
on}
2023/04/11

_{Related note}
3275458

_CVSS
6.1

_{Affected system
type}
Kernel

_Patchday
2023-04

_{Released
on}
2023/04/11

_{Related note}
3309056

_CVSS
6.0

_{Affected system
type}
ABAP

_Patchday
2023-04

_{Released
on}
2023/04/11

_{Related note}
3269352

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2023-04

_{Released
on}
2023/04/11

_{Related note}
3303060

_CVSS
5.3

_{Affected system
type}
ABAP

_Patchday
2023-04

_{Released
on}
2023/04/11

_{Related note}
3315312

_CVSS
5.0

_{Affected system
type}
Kernel

_Patchday
2023-04

_{Released
on}
2023/04/11

_{Related note}
3316509

_CVSS
4.7

_{Affected system
type}
SAP Commerce

_Patchday
2023-04

_{Released
on}
2023/04/11

_{Related note}
3115598

_CVSS
4.4

_{Affected system
type}
ABAP

_Patchday
2023-04

_{Released
on}
2023/04/11

_{Related note}
3301457

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2023-04

_{Released
on}
2023/04/11

_{Related note}
3114489

_CVSS
3.7

_{Affected system
type}
ABAP

_Patchday
2023-04

_{Released
on}
2023/04/11