Patch Day: December 2023
Released December 12, 2023 · 17 notes · Source: SAP Security Patch Day page
Scheduled for December 12, 2023 (second Tuesday)
- New
- 15
- Updated
- 2
- Critical
- 4
- High
- 4
- Highest CVSS
- 10.0
- Known exploited
- 0
Our summary
17 notes (15 new, 2 updated). 4 Critical and 4 High. Highest CVSS 10.0.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Security updates for the browser control Google Chromium delivered with SAP Business Client
OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL)
OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL)
Escalation of Privileges in SAP Business Technology Platform (BTP) Security Services Integration Libraries
Improper Access Control vulnerability in SAP Commerce Cloud
All notes
SAP’s introduction states 15 new notes and 2 updates; SAP’s table lists 17 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 17 of 17
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 2622660 | Security updates for the browser control Google Chromium delivered with SAP Business Client Update | SAP Business Client | Critical | 10.0 | No CVE |
| 3350297 | OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL) Update | SAP ECC and SAP S/4HANA | Critical | 9.1 | CVE-2023-36922 |
| 3399691 | OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL) New | SAP ECC and SAP S/4HANA | Critical | 9.1 | CVE-2023-36922 |
| 3411067 | Escalation of Privileges in SAP Business Technology Platform (BTP) Security Services Integration Libraries New | @sap/xssec | Critical | 9.1 | CVE-2023-49583, CVE-2023-50422, CVE-2023-50423, CVE-2023-50424 |
| 3394567 | Improper Access Control vulnerability in SAP Commerce Cloud New | SAP Commerce Cloud | High | 8.1 | CVE-2023-42481 |
| 3382353 | Cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform New | Business Objects BI Platform | High | 7.5 | CVE-2023-42478 |
| 3385711 | Information disclosure vulnerability in SAP GUI for WIndows and SAP GUI for Java New | SAP GUI for Windows and SAP GUI for Java | High | 7.3 | CVE-2023-49580 |
| 3406244 | Missing Authorization Check in SAP EMARSYS SDK ANDROID New | SAP EMARSYS SDK ANDROID | High | 7.1 | CVE-2023-6542 |
| 3369353 | Cross Site Scripting vulnerability in SAP BusinessObjects Web Intelligence New | SAP BusinessObjects Web Intelligence | Medium | 6.8 | CVE-2023-42476 |
| 3395306 | Command Injection vulnerability in SAP Solution Manager New | SAP Solution Manager | Medium | 6.4 | CVE-2023-49587 |
| 3217087 | Cross-Site Scripting (XSS) vulnerability in the SAP HCM (SMART PAYE solution) New | SAP HCM | Medium | 6.1 | CVE-2023-49577 |
| 3383321 | Cross-Site Scripting (XSS) vulnerability in SAP Biller Direct New | SAP Biller Direct | Medium | 6.1 | CVE-2023-42479 |
| 3159329 | Denial of service (DoS) vulnerability in JSZip library bundled within SAPUI5 New | SAPUI5 | Medium | 5.3 | CVE-2021-23413 |
| 3406786 | Client-Side Desynchronization vulnerability in SAP Fiori Launchpad New | SAP Fiori Launchpad | Medium | 4.3 | CVE-2023-49584 |
| 3392547 | SQL Injection vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.1 | CVE-2023-49581 |
| 3362463 | Denial of service (DOS) in SAP Cloud Connector New | SAP Cloud Connector | Low | 3.5 | CVE-2023-49578 |
| 3363690 | Directory Traversal vulnerability in SAP Master Data Governance New | SAP Master Data Governance | Low | 3.5 | CVE-2023-49058 |