跳到正文
SecondTuesday

补丁日：2023年9月

发布于 2023年9月12日 · 18 条安全说明 · 来源：SAP 安全补丁日页面

计划日期：2023年9月12日（每月第二个星期二）

新发布
13
更新
5
严重
5
高
2
最高 CVSS
10.0
已被利用
0

本月摘要

共 18 条安全说明（新发布 13 条，更新 5 条），其中严重 5 条、高 2 条，最高 CVSS 10.0。

优先修补

排序依据：是否已知被利用（CISA KEV），其次是 SAP 优先级，再次是 CVSS 分数。仅供分诊参考，不能替代您自己的风险评估。

  1. 2622660严重CVSS 10.0

    Security updates for the browser control Google Chromium delivered with SAP Business Client

  2. 3245526严重CVSS 9.9

    Code Injection vulnerability in SAP Business Objects Business Intelligence Platform (CMC)

  3. 3273480严重CVSS 9.9

    Improper access control in SAP NetWeaver AS Java (User Defined Search)

  4. 3320355严重CVSS 9.9

    Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management)

  5. 3340576严重CVSS 9.8

    Missing Authorization check in SAP CommonCryptoLib

全部安全说明

SAP 简介中写明 13 条新安全说明和 5 条更新；SAP 表格共列出 18 行（两者可能不同，例如包含 GitHub 安全公告或补发条目）。

SAP 公告中的最高优先级在 2024 年 12 月及以前标为 “Hot News”，自 2024 年 10 月起标为 “Critical”；本站统一显示为“严重”。

显示 18 / 18

标题CVE
2622660
Security updates for the browser control Google Chromium delivered with SAP Business Client
更新
SAP Business Client严重10.0无 CVE
3245526
Code Injection vulnerability in SAP Business Objects Business Intelligence Platform (CMC)
更新
SAP BusinessObjects BI Platform严重9.9CVE-2023-25616
3273480
Improper access control in SAP NetWeaver AS Java (User Defined Search)
更新
SAP NetWeaver Process Integration严重9.9CVE-2022-41272
3320355
Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management)
新发布
SAP BusinessObjects BI Platform严重9.9CVE-2023-40622
3340576
Missing Authorization check in SAP CommonCryptoLib
新发布
SAP CommonCryptoLib严重9.8CVE-2023-40309
3370490
Insufficient File type validation in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)
新发布
SAP BusinessObjects BI Platform高8.7CVE-2023-42472
3327896
Memory Corruption vulnerability in SAP CommonCryptoLib
新发布
SAP CommonCryptoLib高7.5CVE-2023-40308
3357163
Code Injection vulnerability in SAP PowerDesigner Client
新发布
SAP PowerDesigner Client中6.3CVE-2023-40621
3317702
Arbitrary File Delete via Directory Junction in SAP BusinessObjects Suite(installer)
新发布
SAP BusinessObjects Suite中6.2CVE-2023-40623
3149794
Cross-Site Scripting (XSS) vulnerabilities in jQuery-UI library bundled with SAPUI5
更新
SAPUI5中6.1CVE-2021-41184, CVE-2021-41183, CVE-2021-41182
3156972
URL Redirection vulnerability in SAP S/4HANA (Manage Catalog Items and Cross-Catalog search)
更新
SAP S/4HANA中6.1CVE-2023-40306
3349805
Denial of service (DOS) vulnerability due to the usage of vulnerable version of Commons FileUpload in SAP Quotation Management Insurance (FS-QUO)
新发布
SAP Quotation Management Insurance中5.7CVE-2023-24998
3323163
Code Injection vulnerability in SAP NetWeaver AS ABAP (applications based on Unified Rendering)
新发布
SAP NetWeaver AS ABAP / ABAP Platform中5.5CVE-2023-40624
3326361
Missing Authorization check in S4CORE (Manage Purchase Contracts App)
新发布
S4CORE中5.4CVE-2023-40625
3348142
Missing Authentication check in SAP NetWeaver (Guided Procedures)
新发布
SAP NetWeaver中5.3CVE-2023-41367
3352453
Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Version Management System)
新发布
SAP BusinessObjects BI Platform中5.3CVE-2023-37489
3369680
External Entity Loop vulnerability in SAP S/4HANA (Create Single Payment application)
新发布
SAP S/4HANA低3.5CVE-2023-41369
3355675
Insecure Direct Object Reference (IDOR) vulnerability in SAP S/4HANA (Manage checkbook apps)
新发布
S4 HANA ABAP低2.7CVE-2023-41368