Patch Day: May 2023
Released May 9, 2023 · 24 notes · Source: SAP Security Patch Day page
Scheduled for May 9, 2023 (second Tuesday)
- New
- 18
- Updated
- 6
- Critical
- 2
- High
- 9
- Highest CVSS
- 9.8
- Known exploited
- 0
Our summary
24 notes (18 new, 6 updated). 2 Critical and 9 High. Highest CVSS 9.8.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Multiple vulnerabilities associated with Reprise License Manager 14.2
Information Disclosure vulnerabilities in SAP BusinessObjects Intelligence Platform
Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (CMC)
Improper access control during application start-up in SAP AS NetWeaver JAVA
Privilege escalation vulnerability in SAP IBP add-in for Microsoft Excel
All notes
SAP’s introduction states 18 new notes and 5 updates; SAP’s table lists 24 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 24 of 24
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3328495 | Multiple vulnerabilities associated with Reprise License Manager 14.2 New | SAP 3D Visual Enterprise License Manager | Critical | 9.8 | CVE-2021-44151, CVE-2021-44152, CVE-2021-44153, CVE-2021-44154, CVE-2021-44155 |
| 3307833 | Information Disclosure vulnerabilities in SAP BusinessObjects Intelligence Platform New | SAP BusinessObjects BI Platform | Critical | 9.1 | CVE-2023-28762 |
| 3213507 | Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (CMC) Update | SAP BusinessObjects BI Platform | High | 8.2 | CVE-2022-31596 |
| 3317453 | Improper access control during application start-up in SAP AS NetWeaver JAVA New | SAP AS NetWeaver JAVA | High | 8.2 | CVE-2023-30744 |
| 3323415 | Privilege escalation vulnerability in SAP IBP add-in for Microsoft Excel New | SAP IBP EXCEL ADD-IN | High | 8.2 | CVE-2023-29080 |
| 3217303 | Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (CMC) Update | SAP BusinessObjects BI Platform | High | 7.7 | CVE-2022-39014 |
| 3300624 | Memory Corruption vulnerability in SAP PowerDesigner (Proxy) New | SAP PowerDesigner | High | 7.5 | CVE-2023-32111 |
| 3320145 | Denial of service (DOS) in SAP Commerce New | SAP Commerce Cloud | High | 7.5 | CVE-2022-41966 |
| 3320467 | Information Disclosure vulnerability in SAP GUI for Windows New | SAP GUI for Windows | High | 7.5 | CVE-2023-32113 |
| 3321309 | Information Disclosure vulnerability in SAP Commerce (Backoffice) New | SAP Commerce Cloud | High | 7.5 | CVE-2023-32111 |
| 3326210 | Improper Neutralization of Input in SAPUI5 New | SAPUI5 | High | 7.1 | CVE-2023-30743 |
| 3233226 | Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Commentary DB) Update | SAP BusinessObjects BI Platform | Medium | 6.8 | CVE-2022-32244 |
| 3313484 | Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence platform New | SAP BusinessObjects BI Platform | Medium | 6.3 | CVE-2023-30740 |
| 3309935 | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence platform New | SAP BusinessObjects BI Platform | Medium | 6.1 | CVE-2023-30741 |
| 3315971 | Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI) New | SAP CRM | Medium | 6.1 | CVE-2023-30742 |
| 3319400 | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence platform New | SAP BusinessObjects BI Platform | Medium | 6.1 | CVE-2023-31406 |
| 3213524 | Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Commentary DB) Update | SAP BusinessObjects BI Platform | Medium | 6.0 | CVE-2022-32244 |
| 3312892 | Cross-Site Scripting (XSS) vulnerability in SAP Business Planning and Consolidation New | SAP Business Planning and Consolidation | Medium | 5.4 | CVE-2023-31407 |
| 3315979 | Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI New | SAP CRM WebClient UI | Medium | 5.4 | CVE-2023-29188 |
| 3145769 | Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (CMC) Update | SAP BusinessObjects BI Platform | Medium | 5.3 | CVE-2022-27667 |
| 3038911 | Information Disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Service) New | SAP BusinessObjects BI Platform | Medium | 5.0 | CVE-2023-31404 |
| 3302595 | Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence platform New | SAP BusinessObjects BI Platform | Low | 3.7 | CVE-2023-28764 |
| 3117978 | Information Disclosure vulnerability in SAP Application Interface Framework (ODATA service) Update | SAP Application Interface Framework | Low | 3.1 | CVE-2023-29111 |
| 2335198 | Missing Authorization Check in Vendor Master Hierarchy New | Vendor Master Hierarchy | Low | 2.8 | CVE-2023-32112 |