SAP Security Patch Day – September 2023
El siguiente boletín comparte información sobre notas de seguridad que solucionan vulnerabilidades descubiertas en productos SAP. SAP recomienda encarecidamente que el cliente visite el Portal de soporte y aplique parches de forma prioritaria para proteger su entorno SAP.
| Note | Tittle | Priority | CVSS |
| 3370490 | [CVE-2023-42472] Insufficient File type validation in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)Product-SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface),Versions –420 | High | 8.7 |
| 3327896 | [CVE-2023-40308] Memory Corruption vulnerability in SAP CommonCryptoLibProduct-SAP CommonCryptoLib, Versions–8ProductSAP NetWeaver AS ABAP, SAP NetWeaver AS Java and ABAP Platform of S/4HANA on-premise, Versions -KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KERNEL 7.22, KERNEL 8.04, KERNEL64UC 7.22, KERNEL64UC 7.22EXT, KERNEL64UC 7.53, KERNEL64UC 8.04, KERNEL64NUC 7.22, KERNEL64NUC 7.22EXTProduct–SAP Web Dispatcher, Versions -7.22EXT, 7.53, 7.54, 7.77, 7.85, 7.89Product– SAPContent Server, Versions -6.50, 7.53, 7.54Product–SAPHANA Database, Versions –2.0Product–SAPHost Agent, Versions –722ProductSAPExtended Application Services and Runtime (XSA), Versions -SAP_EXTENDED_APP_SERVICES 1, XS_ADVANCED_RUNTIME 1.00Product–SAPSSOEXT, Versions –17 | High | 7.5 |
| 3357163 | [CVE-2023-40621] Code Injection vulnerability in SAP PowerDesigner ClientProduct-SAP PowerDesignerClient, Version –16.7 | Medium | 6.3 |
| 3317702 | [CVE-2023-40623] Arbitrary File Delete via Directory Junction in SAP BusinessObjects Suite(installer)Product-SAP BusinessObjects Suite (Installer),Version –420, 430 | Medium | 6.2 |
| 3156972 | Update to Security Note released on August2023Patch Day: [CVE-2023-40306] URL Redirection vulnerability in SAP S/4HANA (Manage Catalog Items and Cross-Catalog search)Product-SAP S/4HANA (Manage Catalog Items and Cross-Catalog search), Versions–S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106Medium6.13149794Update to Security Note released on August2023Patch Day:Cross-Site Scripting (XSS) vulnerabilities in jQuery-UI library bundled with SAPUI5Related CVEs-CVE-2021-41184,CVE-2021-41183,CVE-2021-41182,Product– SAPUI5, Versions –SAP_UI 750, SAP_UI 753, SAP_UI 754, SAP_UI 755, SAP_UI 756, UI_700 200 | Medium | 6.1 |
| 3349805 | Denial of service (DOS) vulnerability due to the usage of vulnerable version of Commons FileUpload in SAP Quotation Management Insurance (FS-QUO)Related CVE -CVE-2023-24998Product-SAP Quotation Management Insurance (FS-QUO), Versions –400, 510, 700, 800 | Medium | 5.7 |
| 3323163 | [CVE-2023-40624] Code Injection vulnerability in SAP NetWeaver AS ABAP (applications based on Unified Rendering)Product-SAP NetWeaver AS ABAP (applications based on Unified Rendering), Versions–SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 702, SAP_BASIS 731 | Medium | 5.5 |
| 3326361 | [CVE-2023-40625]Missing Authorization check in S4CORE (Manage Purchase Contracts App)Product-S4CORE (Manage Purchase Contracts App), Versions–102, 103, 104, 105, 106, 107 | Medium | 5.4 |
| 3352453 | [CVE-2023-37489]Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Version Management System)Product-SAP BusinessObjects Business Intelligence Platform (Version Management System),Versions –430 | Medium | 5.3 |
| 3348142 | [CVE-2023-41367] Missing Authentication check in SAP NetWeaver (Guided Procedures)Product-SAP NetWeaver (Guided Procedures), Version –7.50 | Medium | 5.3 |
| 3369680 | [CVE-2023-41369]External Entity Loop vulnerability in SAP S/4HANA (Create Single Payment application)Product-SAP S/4HANA (Create Single Payment application), Versions–100, 101, 102, 103, 104, 105, 106, 107, 108 | Low | 3.5 |
| 3355675 | [CVE-2023-41368] Insecure Direct Object Reference (IDOR) vulnerability in SAP S/4HANA (Manage checkbook apps)Product-S4 HANA ABAP (Manage checkbook apps), Versions–102, 103, 104, 105, 106, 107 | Low | 2.7 |
Referencias
https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a&rc=10
