Patch Day: June 2023
Released June 13, 2023 · 13 notes · Source: SAP Security Patch Day page
Scheduled for June 13, 2023 (second Tuesday)
- New
- 8
- Updated
- 5
- Critical
- 0
- High
- 4
- Highest CVSS
- 8.8
- Known exploited
- 0
Our summary
13 notes (8 new, 5 updated). 0 Critical and 4 High. Highest CVSS 8.8.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Cross-Site Scripting (XSS) vulnerability in SAP Knowledge Warehouse
Stored Cross-Site Scripting (Stored XSS) vulnerability in UI5 Variant Management
Missing Authentication in SAP Plant Connectivity and
Improper Neutralization of Input in SAPUI5
All notes
SAP’s introduction states 8 new notes and 5 updates; SAP’s table lists 13 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 13 of 13
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3102769 | Cross-Site Scripting (XSS) vulnerability in SAP Knowledge Warehouse Update | SAP Knowledge Warehouse | High | 8.8 | CVE-2021-42063 |
| 3324285 | Stored Cross-Site Scripting (Stored XSS) vulnerability in UI5 Variant Management New | SAP UI5 Variant Management | High | 8.2 | CVE-2023-33991 |
| 3301942 | Missing Authentication in SAP Plant Connectivity and New | SAP Plant Connectivity | High | 7.9 | CVE-2023-2827 |
| 3326210 | Improper Neutralization of Input in SAPUI5 Update | SAPUI5 | High | 7.1 | CVE-2023-30743 |
| 3142092 | Information Disclosure vulnerability in SAP S/4HANA (Supplier Factsheet and Enterprise Search for Business Partner, Supplier and Customer) Update | SAP S/4HANA | Medium | 6.5 | CVE-2022-22542 |
| 3318657 | Cross-Site Scripting (XSS) vulnerability in NetWeaver (Design Time Repository) New | SAP NetWeaver | Medium | 6.4 | CVE-2023-33984 |
| 2826092 | Cross-Site Scripting (XSS) vulnerability in SAP CRM ABAP (Grantor Management) New | SAP CRM ABAP | Medium | 6.1 | CVE-2023-33986 |
| 3315971 | Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI) Update | SAP CRM | Medium | 6.1 | CVE-2023-30742 |
| 3319400 | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence platform Update | SAP BusinessObjects BI Platform | Medium | 6.1 | CVE-2023-31406 |
| 3322800 | Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI) New | SAP CRM | Medium | 6.1 | CVE-2023-30742 |
| 3331627 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal New | SAP NetWeaver Enterprise Portal | Medium | 6.1 | CVE-2023-33985 |
| 1794761 | SQL Injection in Master Data Synchronization (MDS COMPARE TOOL) New | Master Data Synchronization | Medium | 4.2 | CVE-2023-32115 |
| 3325642 | Denial of Service in SAP NetWeaver (Change and Transport System) New | SAP NetWeaver | Low | 2.7 | CVE-2023-32114 |