跳到正文
SecondTuesday

补丁日：2023年7月

发布于 2023年7月11日 · 18 条安全说明 · 来源：SAP 安全补丁日页面

计划日期：2023年7月11日（每月第二个星期二）

新发布
16
更新
2
严重
2
高
7
最高 CVSS
10.0
已被利用
0

本月摘要

共 18 条安全说明（新发布 16 条，更新 2 条），其中严重 2 条、高 7 条，最高 CVSS 10.0。

优先修补

排序依据：是否已知被利用（CISA KEV），其次是 SAP 优先级，再次是 CVSS 分数。仅供分诊参考，不能替代您自己的风险评估。

  1. 2622660严重CVSS 10.0

    Security updates for the browser control Google Chromium delivered with SAP Business Client

  2. 3350297严重CVSS 9.1

    OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL)

  3. 3331376高CVSS 8.7

    Directory Traversal vulnerability in SAP NetWeaver (BI CONT ADD ON)

  4. 3233899高CVSS 8.6

    Request smuggling and request concatenation vulnerability in SAP Web Dispatcher

  5. 3324285高CVSS 8.2

    Stored Cross-Site Scripting vulnerability in SAP UI5 (Variant Management)

全部安全说明

SAP 简介中写明 16 条新安全说明和 2 条更新；SAP 表格共列出 18 行（两者可能不同，例如包含 GitHub 安全公告或补发条目）。

SAP 公告中的最高优先级在 2024 年 12 月及以前标为 “Hot News”，自 2024 年 10 月起标为 “Critical”；本站统一显示为“严重”。

显示 18 / 18

标题CVE
2622660
Security updates for the browser control Google Chromium delivered with SAP Business Client
更新
SAP Business Client严重10.0无 CVE
3350297
OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL)
新发布
SAP ECC and SAP S/4HANA严重9.1CVE-2023-36922
3331376
Directory Traversal vulnerability in SAP NetWeaver (BI CONT ADD ON)
新发布
SAP NetWeaver高8.7CVE-2023-33989
3233899
Request smuggling and request concatenation vulnerability in SAP Web Dispatcher
新发布
SAP Web Dispatcher高8.6CVE-2023-33987
3324285
Stored Cross-Site Scripting vulnerability in SAP UI5 (Variant Management)
更新
SAP UI5 Variant Management高8.2CVE-2023-33991
3331029
Denial of service (DOS) vulnerability in SAP SQL Anywhere
新发布
SAP SQL Anywhere高7.8CVE-2023-33990
3340735
Memory Corruption vulnerability in SAP Web Dispatcher
新发布
SAP Web Dispatcher高7.7CVE-2023-35871
3348145
Header Injection in SAP Solution Manager (Diagnostic Agent)
新发布
SAP Solution Manager高7.2CVE-2023-36921
3352058
Unauthenticated blind SSRF in SAP Solution Manager (Diagnostics agent)
新发布
SAP Solution Manager高7.2CVE-2023-36925
3343547
Missing Authentication check in SAP NetWeaver Process Integration (Runtime Workbench)
新发布
SAP NetWeaver Process Integration中6.5CVE-2023-35873
3343564
Missing Authentication check in SAP NetWeaver Process Integration (Message Display Tool)
新发布
SAP NetWeaver Process Integration中6.5CVE-2023-35872
3341211
Improper Access Control in SAP S/4HANA (Manage Journal Entry Template)
新发布
SAP S/4HANA中6.3CVE-2023-35870
3326769
Multiple Vulnerabilities in SAP Enable Now
新发布
SAP Enable Now中6.1CVE-2023-33988, CVE-2023-36918, CVE-2023-36920, CVE-2023-36919
3318850
Improper authentication vulnerability in SAP NetWeaver AS ABAP and ABAP Platform
新发布
SAP NetWeaver AS ABAP / ABAP Platform中6.0CVE-2023-35874
3320702
Password Change rate limit bypass in SAP BusinessObjects Business Intelligence Platform
新发布
SAP BusinessObjects BI Platform中5.9CVE-2023-36917
3324732
Log Injection vulnerability in SAP NetWeaver AS for Java (Log Viewer)
新发布
SAP NetWeaver AS Java中5.3CVE-2023-31405
3351410
Log Injection vulnerability in SAP ERP Defense Forces and Public Security
新发布
SAP ERP Defense Forces and Public Security中4.9CVE-2023-36924
3088078
Missing Authorization Check in SAP Business Warehouse and SAP BW/4HANA
新发布
SAP Business Warehouse and SAP BW/4HANA中4.5CVE-2023-33992