Patch Day: February 2023
Released February 14, 2023 · 26 notes · Source: SAP Security Patch Day page
Scheduled for February 14, 2023 (second Tuesday)
- New
- 21
- Updated
- 5
- Critical
- 1
- High
- 5
- Highest CVSS
- 10.0
- Known exploited
- 0
Our summary
26 notes (21 new, 5 updated). 1 Critical and 5 High. Highest CVSS 10.0.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Security updates for the browser control Google Chromium delivered with SAP Business Client
Code Injection vulnerability in SAP BASIS
Privilege Escalation vulnerability in SAP Start Service
Information disclosure vulnerability in SAP BusinessObjects Business Intelligence platform
Privilege escalation vulnerability in SAP Business Planning and Consolidation
All notes
SAP’s introduction states 21 new notes and 5 updates; SAP’s table lists 26 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 26 of 26
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 2622660 | Security updates for the browser control Google Chromium delivered with SAP Business Client Update | SAP Business Client | Critical | 10.0 | No CVE |
| 3268172 | Code Injection vulnerability in SAP BASIS Update | SAP BASIS | High | 8.8 | CVE-2022-41264 |
| 3285757 | Privilege Escalation vulnerability in SAP Start Service New | SAP Host Agent Service | High | 8.8 | CVE-2023-24523 |
| 3263135 | Information disclosure vulnerability in SAP BusinessObjects Business Intelligence platform New | SAP BusinessObjects BI Platform | High | 8.5 | CVE-2023-0020 |
| 3271091 | Privilege escalation vulnerability in SAP Business Planning and Consolidation Update | SAP Business Planning and Consolidation | High | 8.5 | CVE-2022-41268 |
| 3256787 | Unrestricted Upload of File in SAP BusinessObjects Business Intelligence Platform (CMC) New | SAP BusinessObjects BI Platform | High | 8.4 | CVE-2023-24530 |
| 2985905 | Missing Authorization check in SAP S/4 HANA Map Treasury Correspondence Format Data New | SAP S/4HANA | Medium | 6.5 | CVE-2023-24524 |
| 3265846 | Cross Site Scripting in SAP Solution Manager (BSP Application) New | SAP Solution Manager | Medium | 6.5 | CVE-2023-0024 |
| 3267442 | Cross Site Scripting in SAP Solution Manager (BSP Application) New | SAP Solution Manager | Medium | 6.5 | CVE-2023-0025 |
| 3270509 | URL Redirection vulnerability in SAP Solution Manager New | SAP Solution Manager | Medium | 6.5 | CVE-2023-23855 |
| 3281724 | Missing Authorization check in GRC function modules New | SAP GRC Process Control application | Medium | 6.5 | CVE-2023-0019 |
| 3290901 | Missing Authorization Check in SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests) New | SAP Fiori apps 1.0 for travel management in SAP ERP | Medium | 6.5 | CVE-2023-24528 |
| 3262544 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS for Java (Http Provider Service) Update | SAP NetWeaver AS Java | Medium | 6.1 | CVE-2022-41262 |
| 3266751 | Cross-Site Scripting (XSS) vulnerability in SAP Solution Manager 7.2 New | SAP Solution Manager | Medium | 6.1 | CVE-2023-23852 |
| 3268959 | Multiple vulnerabilities in SAP NetWeaver AS for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2023-23859, CVE-2023-23860 |
| 3269118 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (BSP Framework) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2023-24522 |
| 3269151 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (BSP Framework) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2023-24521 |
| 3271227 | URL Redirection vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2023-23853 |
| 3274585 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (BSP Framework) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2023-25614 |
| 3282663 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (Business Server Pages application) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2023-24529 |
| 3283283 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform Update | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2023-0013 |
| 3293786 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2023-23858 |
| 3275841 | Unrestricted File Upload in SAP Business Planning and Consolidation New | SAP Business Planning and Consolidation | Medium | 5.4 | CVE-2023-23851 |
| 2788178 | Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI New | SAP CRM | Medium | 4.3 | CVE-2023-24525 |
| 3263863 | Cross-Site Scripting (XSS) vulnerability in Web Intelligence Interface New | SAP BusinessObjects BI Platform | Medium | 4.3 | CVE-2023-23856 |
| 3287291 | Missing Authorization check in SAP NetWeaver AS ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Low | 3.8 | CVE-2023-23854 |