SAP© Security Advisories - 08 2023 - SecurityBridge Cloud Platform

We've created the first of its kind, SecurityBridge Cloud Platform, designed to prioritize SAP patches, updates, and remediation strategies that help prevent disruptions to critical business systems. Our security advisories provide SAP users with valuable insights into the security and business implications of operating SAP.

The user interface is designed to be as intuitive as possible, but we’d love to hear your feedback and suggestions.
We hope you enjoy using it!

× Yikes, there is work to do!
This time we found critical correction advisiories. We count 19 and the highest CVSS score is 9.8.

Severity

SAP© Security advisories 19

System Types

Affected SAP© system types

_{Related note}
3312586

_CVSS
4.4

_{Affected system
type}
BI/BO platform

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-39440] Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform

Security Advisory

_{Related note}
3341599

_CVSS
7.8

_{Affected system
type}
SAP PowerDesigner

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-36923] Code Injection vulnerability in SAP PowerDesigner

Security Advisory

_{Related note}
3337797

_CVSS
7.1

_{Affected system
type}
SAP Business One

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-33993] SQL Injection vulnerability in SAP Business One (B1i Layer)

Security Advisory

_{Related note}
3358300

_CVSS
7.6

_{Affected system
type}
SAP Business One

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-39437] Cross-Site Scripting (XSS) vulnerability in SAP Business One

Security Advisory

_{Related note}
3341460

_CVSS
9.8

_{Affected system
type}
SAP PowerDesigner

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-37483] Multiple Vulnerabilities in SAP PowerDesigner

Security Advisory

_{Related note}
3341934

_CVSS
5.9

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-37486] Information Disclosure vulnerability in SAP Commerce (OCC API)

Security Advisory

_{Related note}
3312047

_CVSS
7.5

_{Affected system
type}
BI/BO platform

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
Denial of Service (DoS) vulnerability due to the usage of vulnerable version of Commons FileUpload in SAP BusinessObjects Business Intelligence Platform (CMC)

Security Advisory

_{Related note}
3358328

_CVSS
3.7

_{Affected system
type}
SAP Host Agent

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-36926] Information disclosure vulnerability in SAP Host Agent

Security Advisory

_{Related note}
3149794

_CVSS
6.1

_{Affected system
type}
SAP UI5

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
Cross-Site Scripting (XSS) vulnerabilities in jQuery-UI library bundled with SAPUI5

Security Advisory

_{Related note}
3156972

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-40306] URL Redirection vulnerability in SAP S/4HANA (Manage Catalog Items and Cross-Catalog search)

Security Advisory

_{Related note}
3348000

_CVSS
4.9

_{Affected system
type}
ABAP

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-37492] Missing Authorization check in SAP NetWeaver AS ABAP and ABAP Platform

Security Advisory

_{Related note}
3346500

_CVSS
8.8

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-39439] Improper authentication in SAP Commerce Cloud

Security Advisory

_{Related note}
3333616

_CVSS
5.3

_{Affected system
type}
SAP Business One

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-37487] Security Misconfiguration vulnerability in SAP Business One (Service Layer)

Security Advisory

_{Related note}
3350297

_CVSS
9.1

_{Affected system
type}
ABAP

_Patchday
2023-08

_{Released
on}
2023/07/11

Description
[CVE-2023-36922] OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL)

Security Advisory

_{Related note}
3344295

_CVSS
7.5

_{Affected system
type}
Kernel

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-37491] Improper Authorization check vulnerability in SAP Message Server

Security Advisory

_{Related note}
3350494

_CVSS
6.1

_{Affected system
type}
Java

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-37488] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Process Integration

Security Advisory

_{Related note}
3317710

_CVSS
7.6

_{Affected system
type}
BI/BO platform

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-37490] Binary hijack in SAP BusinessObjects Business Intelligence Suite (installer)

Security Advisory

_{Related note}
2032723

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2023-08

_{Released
on}
2014/11/11

Description
Switchable authorization checks for RFC in SRM

Security Advisory

_{Related note}
2067220

_CVSS
5.8

_{Affected system
type}
ABAP

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-39436] Information Disclosure in SAP Supplier Relationship Management

Security Advisory

Notifications

Severity

SAP© Security advisories 19

System Types

Affected SAP© system types

Related note 3312586

CVSS 4.4

Affected system type BI/BO platform

Patchday2023-08

Released on2023/08/08

Related note 3341599

CVSS 7.8

Affected system type SAP PowerDesigner

Patchday2023-08

Released on2023/08/08

Related note 3337797

CVSS 7.1

Affected system type SAP Business One

Patchday2023-08

Released on2023/08/08

Related note 3358300

CVSS 7.6

Affected system type SAP Business One

Patchday2023-08

Released on2023/08/08

Related note 3341460

CVSS 9.8

Affected system type SAP PowerDesigner

Patchday2023-08

Released on2023/08/08

Related note 3341934

CVSS 5.9

Affected system type SAP Commerce Cloud

Patchday2023-08

Released on2023/08/08

Related note 3312047

CVSS 7.5

Affected system type BI/BO platform

Patchday2023-08

Released on2023/08/08

Related note 3358328

CVSS 3.7

Affected system type SAP Host Agent

Patchday2023-08

Released on2023/08/08

Related note 3149794

CVSS 6.1

Affected system type SAP UI5

Patchday2023-08

Released on2023/08/08

Related note 3156972

CVSS 6.1

Affected system type ABAP

Patchday2023-08

Released on2023/08/08

Related note 3348000

CVSS 4.9

Affected system type ABAP

Patchday2023-08

Released on2023/08/08

Related note 3346500

CVSS 8.8

Affected system type SAP Commerce Cloud

Patchday2023-08

Released on2023/08/08

Related note 3333616

CVSS 5.3

Affected system type SAP Business One

Patchday2023-08

Released on2023/08/08

Related note 3350297

CVSS 9.1

Affected system type ABAP

Patchday2023-08

Released on2023/07/11

Related note 3344295

CVSS 7.5

Affected system type Kernel

Patchday2023-08

Released on2023/08/08

_{Related note}
3312586

_CVSS
4.4

_{Affected system
type}
BI/BO platform

_Patchday
2023-08

_{Released
on}
2023/08/08

_{Related note}
3341599

_CVSS
7.8

_{Affected system
type}
SAP PowerDesigner

_Patchday
2023-08

_{Released
on}
2023/08/08

_{Related note}
3337797

_CVSS
7.1

_{Affected system
type}
SAP Business One

_Patchday
2023-08

_{Released
on}
2023/08/08

_{Related note}
3358300

_CVSS
7.6

_{Affected system
type}
SAP Business One

_Patchday
2023-08

_{Released
on}
2023/08/08

_{Related note}
3341460

_CVSS
9.8

_{Affected system
type}
SAP PowerDesigner

_Patchday
2023-08

_{Released
on}
2023/08/08

_{Related note}
3341934

_CVSS
5.9

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2023-08

_{Released
on}
2023/08/08

_{Related note}
3312047

_CVSS
7.5

_{Affected system
type}
BI/BO platform

_Patchday
2023-08

_{Released
on}
2023/08/08

_{Related note}
3358328

_CVSS
3.7

_{Affected system
type}
SAP Host Agent

_Patchday
2023-08

_{Released
on}
2023/08/08

_{Related note}
3149794

_CVSS
6.1

_{Affected system
type}
SAP UI5

_Patchday
2023-08

_{Released
on}
2023/08/08

_{Related note}
3156972

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-08

_{Released
on}
2023/08/08

_{Related note}
3348000

_CVSS
4.9

_{Affected system
type}
ABAP

_Patchday
2023-08

_{Released
on}
2023/08/08

_{Related note}
3346500

_CVSS
8.8

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2023-08

_{Released
on}
2023/08/08

_{Related note}
3333616

_CVSS
5.3

_{Affected system
type}
SAP Business One

_Patchday
2023-08

_{Released
on}
2023/08/08

_{Related note}
3350297

_CVSS
9.1

_{Affected system
type}
ABAP

_Patchday
2023-08

_{Released
on}
2023/07/11

_{Related note}
3344295

_CVSS
7.5

_{Affected system
type}
Kernel

_Patchday
2023-08

_{Released
on}
2023/08/08

_{Related note}
3350494

_CVSS
6.1

_{Affected system
type}
Java

_Patchday
2023-08

_{Released
on}
2023/08/08