补丁日：2023年4月
发布于 2023年4月11日 · 24 条安全说明 · 来源：SAP 安全补丁日页面
计划日期：2023年4月11日（每月第二个星期二）
- 新发布
- 19
- 更新
- 5
- 严重
- 5
- 高
- 1
- 最高 CVSS
- 10.0
- 已被利用
- 0
本月摘要
共 24 条安全说明（新发布 19 条，更新 5 条），其中严重 5 条、高 1 条，最高 CVSS 10.0。
优先修补
排序依据：是否已知被利用（CISA KEV），其次是 SAP 优先级，再次是 CVSS 分数。仅供分诊参考，不能替代您自己的风险评估。
Security updates for the browser control Google Chromium delivered with SAP Business Client
Multiple vulnerabilities in SAP Diagnostics Agent (OSCommand Bridge and EventLogServiceCollector)
Improper access control in SAP NetWeaver AS Java (User Defined Search)
Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management)
Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
全部安全说明
SAP 简介中写明 18 条新安全说明和 5 条更新；SAP 表格共列出 24 行（两者可能不同，例如包含 GitHub 安全公告或补发条目）。
SAP 公告中的最高优先级在 2024 年 12 月及以前标为 “Hot News”，自 2024 年 10 月起标为 “Critical”；本站统一显示为“严重”。
显示 24 / 24
| 标题 | CVE | ||||
|---|---|---|---|---|---|
| 2622660 | Security updates for the browser control Google Chromium delivered with SAP Business Client 更新 | SAP Business Client | 严重 | 10.0 | 无 CVE |
| 3305369 | Multiple vulnerabilities in SAP Diagnostics Agent (OSCommand Bridge and EventLogServiceCollector) 新发布 | SAP Diagnostics Agent | 严重 | 10.0 | CVE-2023-27497, CVE-2023-27267 |
| 3273480 | Improper access control in SAP NetWeaver AS Java (User Defined Search) 更新 | SAP NetWeaver Process Integration | 严重 | 9.9 | CVE-2022-41272 |
| 3298961 | Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management) 新发布 | SAP BusinessObjects BI Platform | 严重 | 9.8 | CVE-2023-28765 |
| 3294595 | Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform 更新 | SAP NetWeaver AS ABAP / ABAP Platform | 严重 | 9.6 | CVE-2023-27269 |
| 3305907 | Directory Traversal vulnerability in SAP NetWeaver (BI CONT ADD ON) 新发布 | SAP NetWeaver | 高 | 8.7 | CVE-2023-29186 |
| 3312733 | Information Disclosure vulnerability in SAP Landscape Management 新发布 | SAP Landscape Management | 中 | 6.8 | CVE-2023-26458 |
| 3311624 | DLL Hijacking vulnerability in SapSetup (Software Installation Program) 新发布 | SapSetup | 中 | 6.7 | CVE-2023-29187 |
| 3289994 | Missing Authentication check in SAP NetWeaver Enterprise Portal 新发布 | SAP NetWeaver Enterprise Portal | 中 | 6.5 | CVE-2023-28761 |
| 3290901 | Missing Authorization Check in SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests) 更新 | SAP Fiori apps 1.0 for travel management in SAP ERP | 中 | 6.5 | CVE-2023-24528 |
| 3296378 | Denial of Service in SAP NetWeaver AS for ABAP and ABAP Platform 新发布 | SAP NetWeaver AS ABAP / ABAP Platform | 中 | 6.5 | CVE-2023-28763 |
| 3275458 | Cross-Site Scripting (XSS) vulnerability in SAP GUI for HTML 新发布 | SAP GUI for HTML | 中 | 6.1 | CVE-2023-27499 |
| 3309056 | Code Injection vulnerability in SAP CRM 新发布 | SAP CRM | 中 | 6.0 | CVE-2023-27897 |
| 3000663 | HTTP Request Smuggling in SAP Web Dispatcher and Internet Communication Manager 更新 | SAP Web Dispatcher and Internet Communication Manager | 中 | 5.4 | CVE-2021-33683 |
| 3269352 | HTTP Verb Tampering vulnerability in SAP CRM WebClient UI 新发布 | SAP CRM | 中 | 5.4 | CVE-2023-29189 |
| 3287784 | Improper Access Control in SAP NetWeaver AS Java for Deploy Service 新发布 | SAP NetWeaver AS Java for Deploy Service | 中 | 5.3 | CVE-2023-24527 |
| 3303060 | Denial of Service (DOS) in SAP NetWeaver AS for ABAP (Business Server Pages) 新发布 | SAP NetWeaver AS ABAP / ABAP Platform | 中 | 5.3 | CVE-2023-29185 |
| 3315312 | IP filter vulnerability in ABAP Platform and SAP Web Dispatcher 新发布 | ABAP Platform and SAP Web Dispatcher | 中 | 5.0 | CVE-2023-29108 |
| 3316509 | Remote Code Execution vulnerability in SAP Commerce 新发布 | SAP Commerce Cloud | 中 | 4.7 | CVE-2020-13936 |
| 3115598 | Code Injection vulnerability in SAP Application Interface Framework (Log Message View of Message Dashboard) 新发布 | SAP Application Interface Framework | 中 | 4.4 | CVE-2023-29109 |
| 3301457 | Missing Authorization check in SAP HCM Fiori App My Forms (Fiori 2.0) 新发布 | SAP HCM Fiori App My Forms | 中 | 4.3 | CVE-2023-1903 |
| 3113349 | Code Injection vulnerability in SAP Application Interface Framework (Custom Hint of Message Dashboard) 新发布 | SAP Application Interface Framework | 低 | 3.7 | CVE-2023-29110 |
| 3114489 | Code Injection vulnerability in SAP Application Interface Framework (Message Monitoring and Message Monitoring for Administrators Application) 新发布 | SAP Application Interface Framework | 低 | 3.7 | CVE-2023-29112 |
| 3117978 | Information Disclosure vulnerability in SAP Application Interface Framework (ODATA service) 新发布 | SAP Application Interface Framework | 低 | 3.1 | CVE-2023-29111 |