Security Advisories

We've created the first of its kind, SecurityBridge ^{Cloud Platform} to prioritize SAP patches, updates and the remediation strategies essential for preventing the disruption of vital business systems. Our security advisories enable SAP users to understand the security and business implications of running SAP.

The user interface, is designed to be as intuitive as possible but we'd love to hear your feedback and opinions.
We hope you like it!

× Yikes, there is work to do!
This time we found critical correction advisiories. We count 150 and the highest CVSS score is 10.0.

Severity

SAP© Security advisories 150

System Types

Affected SAP© system types

_{Related note}
3355658

_CVSS
9.6

_{Affected system
type}
SAP Business One

_Patchday
2023-11

_{Released
on}
2023/11/14

Description
[CVE-2023-31403] Improper Access Control vulnerability in SAP Business One product installation

Security Advisory

_{Related note}
3362849

_CVSS
5.3

_{Affected system
type}
Kernel

_Patchday
2023-11

_{Released
on}
2023/11/14

Description
[CVE-2023-41366] Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform

Security Advisory

_{Related note}
3366410

_CVSS
5.3

_{Affected system
type}
Java

_Patchday
2023-11

_{Released
on}
2023/11/14

Description
[CVE-2023-42480] Information Disclosure in NetWeaver AS Java Logon

Security Advisory

_{Related note}
3333426

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2023-10

_{Released
on}
2023/10/26

Description
[CVE-2023-42477] Server-Side Request Forgery in SAP NetWeaver AS Java (GRMG Heartbeat application)

Security Advisory

_{Related note}
3357154

_CVSS
6.5

_{Affected system
type}
SAP PowerDesigner

_Patchday
2023-10

_{Released
on}
2023/10/10

Description
[CVE-2023-40310] Missing XML Validation vulnerability in SAP PowerDesigner Client (BPMN2 import)

Security Advisory

_{Related note}
3371873

_CVSS
5.3

_{Affected system
type}
Java

_Patchday
2023-10

_{Released
on}
2023/10/10

Description
Update 1 to Security Note 3324732: [CVE-2023-31405] Log Injection vulnerability in SAP NetWeaver AS for Java (Log Viewer)

Security Advisory

_{Related note}
3222121

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2023-10

_{Released
on}
2023/10/10

Description
[CVE-2023-42475] Information Disclosure Vulnerability in Statutory Reporting

Security Advisory

_{Related note}
3372991

_CVSS
6.8

_{Affected system
type}
BI/BO platform

_Patchday
2023-10

_{Released
on}
2023/10/10

Description
[CVE-2023-42474] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Web Intelligence

Security Advisory

_{Related note}
3338380

_CVSS
4.3

_{Affected system
type}
SAP Business One

_Patchday
2023-10

_{Released
on}
2023/10/10

Description
[CVE-2023-41365] Information Disclosure vulnerability in SAP Business One (B1i)

Security Advisory

_{Related note}
3323163

_CVSS
5.5

_{Affected system
type}
ABAP

_Patchday
2023-09

_{Released
on}
2023/09/12

Description
[CVE-2023-40624] Code Injection vulnerability in SAP NetWeaver AS ABAP (applications based on Unified Rendering)

Security Advisory

_{Related note}
3326361

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2023-09

_{Released
on}
2023/09/12

Description
[CVE-2023-40625] Missing Authorization check in Manage Purchase Contracts App

Security Advisory

_{Related note}
3352453

_CVSS
5.3

_{Affected system
type}
BI/BO platform

_Patchday
2023-09

_{Released
on}
2023/09/12

Description
[CVE-2023-37489] Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Version Management System)

Security Advisory

_{Related note}
3349805

_CVSS
5.7

_{Affected system
type}
Java

_Patchday
2023-09

_{Released
on}
2023/09/12

Description
Denial of service (DOS) vulnerability due to the usage of vulnerable version of Commons File Upload in SAP Quotation Management Insurance (FS-QUO)

Security Advisory

_{Related note}
3320355

_CVSS
9.9

_{Affected system
type}
SAP BI

_Patchday
2023-09

_{Released
on}
2023/09/12

Description
[CVE-2023-40622] Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management)

Security Advisory

_{Related note}
3355675

_CVSS
2.7

_{Affected system
type}
ABAP

_Patchday
2023-09

_{Released
on}
2023/09/12

Description
[CVE-2023-41368] Insecure Direct Object Reference (IDOR) vulnerability in SAP S/4HANA (Manage checkbook apps)

Security Advisory

_{Related note}
3357163

_CVSS
6.3

_{Affected system
type}
PowerDesigner

_Patchday
2023-09

_{Released
on}
2023/09/12

Description
[CVE-2023-40621] Code Injection vulnerability in SAP PowerDesigner Client

Security Advisory

_{Related note}
3317702

_CVSS
6.2

_{Affected system
type}
BI/BO platform

_Patchday
2023-09

_{Released
on}
2023/09/12

Description
[CVE-2023-40623] Arbitrary File Delete via Directory Junction in SAP BusinessObjects Suite(installer)

Security Advisory

_{Related note}
3327896

_CVSS
7.5

_{Affected system
type}
Kernel

_Patchday
2023-09

_{Released
on}
2023/09/12

Description
[CVE-2023-40308] Memory Corruption vulnerability in SAP CommonCryptoLib

Security Advisory

_{Related note}
3340576

_CVSS
9.8

_{Affected system
type}
Kernel, HANA...

_Patchday
2023-09

_{Released
on}
2023/09/12

Description
[CVE-2023-40309] Missing Authorization check in SAP CommonCryptoLib

Security Advisory

_{Related note}
3369680

_CVSS
3.5

_{Affected system
type}
ABAP

_Patchday
2023-09

_{Released
on}
2023/09/12

Description
[CVE-2023-41369] External Entity Loop vulnerability in SAP S/4HANA (Create Single Payment application)

Security Advisory

_{Related note}
3348142

_CVSS
5.3

_{Affected system
type}
Java

_Patchday
2023-09

_{Released
on}
2023/09/12

Description
[CVE-2023-41367] Missing Authentication check in SAP NetWeaver (Guided Procedures)

Security Advisory

_{Related note}
3370490

_CVSS
8.7

_{Affected system
type}
BI/BO platform

_Patchday
2023-09

_{Released
on}
2023/09/12

Description
[CVE-2023-42472] Insufficient File type validation in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)

Security Advisory

_{Related note}
2067220

_CVSS
5.8

_{Affected system
type}
ABAP

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-39436] Information Disclosure in SAP Supplier Relationship Management

Security Advisory

_{Related note}
3341599

_CVSS
7.8

_{Affected system
type}
SAP PowerDesigner

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-36923] Code Injection vulnerability in SAP PowerDesigner

Security Advisory

_{Related note}
3312586

_CVSS
4.4

_{Affected system
type}
BI/BO platform

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-39440] Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform

Security Advisory

_{Related note}
3346500

_CVSS
8.8

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-39439] Improper authentication in SAP Commerce Cloud

Security Advisory

_{Related note}
3333616

_CVSS
5.3

_{Affected system
type}
SAP Business One

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-37487] Security Misconfiguration vulnerability in SAP Business One (Service Layer)

Security Advisory

_{Related note}
3350494

_CVSS
6.1

_{Affected system
type}
Java

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-37488] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Process Integration

Security Advisory

_{Related note}
3350297

_CVSS
9.1

_{Affected system
type}
ABAP

_Patchday
2023-08

_{Released
on}
2023/07/11

Description
[CVE-2023-36922] OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL)

Security Advisory

_{Related note}
3317710

_CVSS
7.6

_{Affected system
type}
BI/BO platform

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-37490] Binary hijack in SAP BusinessObjects Business Intelligence Suite (installer)

Security Advisory

_{Related note}
3344295

_CVSS
7.5

_{Affected system
type}
Kernel

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-37491] Improper Authorization check vulnerability in SAP Message Server

Security Advisory

_{Related note}
2032723

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2023-08

_{Released
on}
2014/11/11

Description
Switchable authorization checks for RFC in SRM

Security Advisory

_{Related note}
3341460

_CVSS
9.8

_{Affected system
type}
SAP PowerDesigner

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-37483] Multiple Vulnerabilities in SAP PowerDesigner

Security Advisory

_{Related note}
3341934

_CVSS
5.9

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-37486] Information Disclosure vulnerability in SAP Commerce (OCC API)

Security Advisory

_{Related note}
3312047

_CVSS
7.5

_{Affected system
type}
BI/BO platform

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
Denial of Service (DoS) vulnerability due to the usage of vulnerable version of Commons FileUpload in SAP BusinessObjects Business Intelligence Platform (CMC)

Security Advisory

_{Related note}
3358328

_CVSS
3.7

_{Affected system
type}
SAP Host Agent

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-36926] Information disclosure vulnerability in SAP Host Agent

Security Advisory

_{Related note}
3149794

_CVSS
6.1

_{Affected system
type}
SAP UI5

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
Cross-Site Scripting (XSS) vulnerabilities in jQuery-UI library bundled with SAPUI5

Security Advisory

_{Related note}
3358300

_CVSS
7.6

_{Affected system
type}
SAP Business One

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-39437] Cross-Site Scripting (XSS) vulnerability in SAP Business One

Security Advisory

_{Related note}
3337797

_CVSS
7.1

_{Affected system
type}
SAP Business One

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-33993] SQL Injection vulnerability in SAP Business One (B1i Layer)

Security Advisory

_{Related note}
3348000

_CVSS
4.9

_{Affected system
type}
ABAP

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-37492] Missing Authorization check in SAP NetWeaver AS ABAP and ABAP Platform

Security Advisory

_{Related note}
3156972

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-08

_{Released
on}
2023/08/08

Description
[CVE-2023-40306] URL Redirection vulnerability in SAP S/4HANA (Manage Catalog Items and Cross-Catalog search)

Security Advisory

_{Related note}
3352058

_CVSS
7.2

_{Affected system
type}
Java

_Patchday
2023-07

_{Released
on}
2023/07/11

Description
[CVE-2023-36925] Unauthenticated blind SSRF in SAP Solution Manager (Diagnostics agent)

Security Advisory

_{Related note}
3318850

_CVSS
6.0

_{Affected system
type}
Kernel

_Patchday
2023-07

_{Released
on}
2023/07/11

Description
[CVE-2023-35874] Improper authentication vulnerability in SAP NetWeaver AS ABAP and ABAP Platform

Security Advisory

_{Related note}
3348145

_CVSS
7.2

_{Affected system
type}
Java

_Patchday
2023-07

_{Released
on}
2023/07/11

Description
[CVE-2023-36921] Header Injection in SAP Solution Manager (Diagnostic Agent)

Security Advisory

_{Related note}
3341211

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2023-07

_{Released
on}
2023/07/11

Description
[CVE-2023-35870] Improper Access Control in SAP S/4HANA (Manage Journal Entry Template)

Security Advisory

_{Related note}
3331029

_CVSS
7.8

_{Affected system
type}
Sybase platform

_Patchday
2023-07

_{Released
on}
2023/07/11

Description
[CVE-2023-33990] Denial of service (DOS) vulnerability in SAP SQL Anywhere

Security Advisory

_{Related note}
3320702

_CVSS
5.9

_{Affected system
type}
BI/BO platform

_Patchday
2023-07

_{Released
on}
2023/07/11

Description
[CVE-2023-36917] Password Change rate limit bypass in SAP BusinessObjects Business Intelligence Platform

Security Advisory

_{Related note}
3351410

_CVSS
4.9

_{Affected system
type}
ABAP

_Patchday
2023-07

_{Released
on}
2023/07/11

Description
[CVE-2023-36924] Log Injection vulnerability in SAP ERP Defense Forces and Public Security

Security Advisory

_{Related note}
3343564

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2023-07

_{Released
on}
2023/07/11

Description
[CVE-2023-35872] Missing Authentication check in SAP NetWeaver Process Integration (Message Display Tool)

Security Advisory

_{Related note}
3233899

_CVSS
8.6

_{Affected system
type}
Kernel

_Patchday
2023-07

_{Released
on}
2023/07/11

Description
[CVE-2023-33987] Request smuggling and request concatenation vulnerability in SAP Web Dispatcher

Security Advisory

_{Related note}
3331376

_CVSS
8.7

_{Affected system
type}
ABAP

_Patchday
2023-07

_{Released
on}
2023/07/11

Description
[CVE-2023-33989] Directory Traversal vulnerability in SAP NetWeaver (BI CONT ADD ON)

Security Advisory

_{Related note}
3343547

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2023-07

_{Released
on}
2023/07/11

Description
[CVE-2023-35873] Missing Authentication check in SAP NetWeaver Process Integration (Runtime Workbench)

Security Advisory

_{Related note}
3088078

_CVSS
4.5

_{Affected system
type}
BI/BO platform

_Patchday
2023-07

_{Released
on}
2023/07/11

Description
[CVE-2023-33992] Missing Authorization Check in SAP Business Warehouse and SAP BW/4HANA

Security Advisory

_{Related note}
3324732

_CVSS
5.3

_{Affected system
type}
Java

_Patchday
2023-07

_{Released
on}
2023/06/11

Description
[CVE-2023-31405] Log Injection vulnerability in SAP NetWeaver AS for Java (Log Viewer)

Security Advisory

_{Related note}
3326769

_CVSS
6.1

_{Affected system
type}
SAP Enable Now

_Patchday
2023-07

_{Released
on}
2023/07/11

Description
[Multiple CVEs] Multiple Vulnerabilities in SAP Enable Now

Security Advisory

_{Related note}
3340735

_CVSS
7.7

_{Affected system
type}
Kernel

_Patchday
2023-07

_{Released
on}
2023/07/11

Description
[CVE-2023-35871] Memory Corruption vulnerability in SAP Web Dispatcher

Security Advisory

_{Related note}
3322800

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-06

_{Released
on}
2023/06/13

Description
Update 1 to security note 3315971 - [CVE-2023-30742] Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)

Security Advisory

_{Related note}
3331627

_CVSS
6.1

_{Affected system
type}
Java

_Patchday
2023-06

_{Released
on}
2023/06/13

Description
[CVE-2023-33985] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver (Enterprise Portal)

Security Advisory

_{Related note}
3325642

_CVSS
2.7

_{Affected system
type}
ABAP

_Patchday
2023-06

_{Released
on}
2023/06/13

Description
[CVE-2023-32114] Denial of Service in SAP NetWeaver (Change and Transport System)

Security Advisory

_{Related note}
3318657

_CVSS
6.4

_{Affected system
type}
SAP...

_Patchday
2023-06

_{Released
on}
2023/06/13

Description
[CVE-2023-33984] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver (Design Time Repository)

Security Advisory

_{Related note}
3324285

_CVSS
8.2

_{Affected system
type}
SAP UI5

_Patchday
2023-06

_{Released
on}
2023/06/13

Description
[CVE-2023-33991] Stored Cross-Site Scripting vulnerability in SAP UI5 (Variant Management)

Security Advisory

_{Related note}
2826092

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-06

_{Released
on}
2023/06/13

Description
[CVE-2023-33986] Cross-Site Scripting (XSS) vulnerability in SAP CRM ABAP (Grantor Management)

Security Advisory

_{Related note}
3315979

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2023-05

_{Released
on}
2023/05/09

Description
[CVE-2023-29188] Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI

Security Advisory

_{Related note}
3312892

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2023-05

_{Released
on}
2023/05/09

Description
[CVE-2023-31407] Cross-Site Scripting (XSS) vulnerability in SAP Business Planning and Consolidation

Security Advisory

_{Related note}
3313484

_CVSS
6.3

_{Affected system
type}
BI/BO platform

_Patchday
2023-05

_{Released
on}
2023/05/09

Description
[CVE-2023-30740] Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence platform

Security Advisory

_{Related note}
1794761

_CVSS
4.2

_{Affected system
type}
ABAP

_Patchday
2023-05

_{Released
on}
2023/05/23

Description
[CVE-2023-32115] SQL Injection in Master Data Synchronization (MDS COMPARE TOOL)

Security Advisory

_{Related note}
2335198

_CVSS
2.8

_{Affected system
type}
ABAP

_Patchday
2023-05

_{Released
on}
2023/05/09

Description
[CVE-2023-32112] Missing Authorization Check in Vendor Master Hierarchy

Security Advisory

_{Related note}
3301942

_CVSS
7.9

_{Affected system
type}
SAP Plant Connectivity

_Patchday
2023-05

_{Released
on}
2023/05/23

Description
[CVE-2023-2827] Missing Authentication in SAP Plant Connectivity and Production Connector for SAP Digital Manufacturing

Security Advisory

_{Related note}
3323415

_CVSS
8.2

_{Affected system
type}
SAP Integrated...

_Patchday
2023-05

_{Released
on}
2023/05/09

Description
[CVE-2023-29080] Privilege escalation vulnerability in SAP IBP, add-in for Microsoft Excel

Security Advisory

_{Related note}
3326210

_CVSS
7.1

_{Affected system
type}
ABAP

_Patchday
2023-05

_{Released
on}
2023/05/09

Description
[CVE-2023-30743] Improper Neutralization of Input in SAPUI5

Security Advisory

_{Related note}
3320145

_CVSS
7.5

_{Affected system
type}
SAP Commerce

_Patchday
2023-05

_{Released
on}
2023/05/09

Description
Denial of service (DOS) in SAP Commerce

Security Advisory

_{Related note}
3321309

_CVSS
7.5

_{Affected system
type}
SAP Commerce

_Patchday
2023-05

_{Released
on}
2023/05/09

Description
Information Disclosure vulnerability in SAP Commerce (Backoffice)

Security Advisory

_{Related note}
3307833

_CVSS
9.1

_{Affected system
type}
BI/BO platform

_Patchday
2023-05

_{Released
on}
2023/05/09

Description
[CVE-2023-28762] Information Disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Console)

Security Advisory

_{Related note}
3328495

_CVSS
9.8

_{Affected system
type}
Reprise License Manager

_Patchday
2023-05

_{Released
on}
2023/05/09

Description
Multiple vulnerabilities associated with Reprise License Manager 14.2 component used with SAP 3D Visual Enterprise License Manager

Security Advisory

_{Related note}
3317453

_CVSS
8.2

_{Affected system
type}
Java

_Patchday
2023-05

_{Released
on}
2023/05/09

Description
[CVE-2023-30744] Improper access control during application start-up in SAP AS NetWeaver JAVA

Security Advisory

_{Related note}
3319400

_CVSS
6.1

_{Affected system
type}
BI/BO platform

_Patchday
2023-05

_{Released
on}
2023/05/09

Description
[CVE-2023-31406] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence platform

Security Advisory

_{Related note}
3300624

_CVSS
7.5

_{Affected system
type}
SAP PowerDesigner

_Patchday
2023-05

_{Released
on}
2023/05/09

Description
[CVE-2023-32111] Memory Corruption vulnerability in SAP PowerDesigner (Proxy)

Security Advisory

_{Related note}
3038911

_CVSS
5.0

_{Affected system
type}
BI/BO platform

_Patchday
2023-05

_{Released
on}
2023/05/09

Description
[CVE-2023-31404] Information Disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Service)

Security Advisory

_{Related note}
3320467

_CVSS
7.5

_{Affected system
type}
SAP GUI / Frontend

_Patchday
2023-05

_{Released
on}
2023/05/09

Description
[CVE-2023-32113] Information Disclosure vulnerability in SAP GUI for Windows

Security Advisory

_{Related note}
3302595

_CVSS
3.7

_{Affected system
type}
BI/BO platform

_Patchday
2023-05

_{Released
on}
2023/05/09

Description
[CVE-2023-28764] Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence platform

Security Advisory

_{Related note}
3309935

_CVSS
6.1

_{Affected system
type}
BI/BO platform

_Patchday
2023-05

_{Released
on}
2023/05/09

Description
[CVE-2023-30741] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence platform

Security Advisory

_{Related note}
3315971

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-05

_{Released
on}
2023/05/09

Description
[CVE-2023-30742] Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)

Security Advisory

_{Related note}
3301457

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-1903] Missing Authorization check in SAP HCM Fiori App My Forms (Fiori 2.0)

Security Advisory

_{Related note}
3315312

_CVSS
5.0

_{Affected system
type}
Kernel

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-29108] IP filter vulnerability in ABAP Platform and SAP Web Dispatcher

Security Advisory

_{Related note}
3303060

_CVSS
5.3

_{Affected system
type}
ABAP

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-29185] Denial of Service (DOS) in SAP NetWeaver AS for ABAP (Business Server Pages)

Security Advisory

_{Related note}
3316509

_CVSS
4.7

_{Affected system
type}
SAP Commerce

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
Remote Code Execution vulnerability in SAP Commerce

Security Advisory

_{Related note}
3269352

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-29189] HTTP Verb Tampering vulnerability in SAP CRM (WebClient UI)

Security Advisory

_{Related note}
3275458

_CVSS
6.1

_{Affected system
type}
Kernel

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-27499] Cross-Site Scripting (XSS) vulnerability in SAP GUI for HTML

Security Advisory

_{Related note}
3296378

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-28763] - Denial of Service in SAP NetWeaver AS for ABAP and ABAP Platform

Security Advisory

_{Related note}
3287784

_CVSS
5.3

_{Affected system
type}
Java

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-24527] Improper Access Control in SAP NetWeaver AS Java for Deploy Service

Security Advisory

_{Related note}
3305369

_CVSS
10.0

_{Affected system
type}
Java

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-27497] Multiple vulnerabilities in SAP Diagnostics Agent (OSCommand Bridge and EventLogServiceCollector)

Security Advisory

_{Related note}
3117978

_CVSS
3.1

_{Affected system
type}
ABAP

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-29111] Information Disclosure vulnerability in SAP Application Interface Framework (ODATA service)

Security Advisory

_{Related note}
3309056

_CVSS
6.0

_{Affected system
type}
ABAP

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-27897] Code Injection vulnerability in SAP CRM

Security Advisory

_{Related note}
3289994

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-28761] Missing Authentication check in SAP NetWeaver Enterprise Portal

Security Advisory

_{Related note}
3298961

_CVSS
9.8

_{Affected system
type}
BI/BO platform

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-28765] Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management )

Security Advisory

_{Related note}
3311624

_CVSS
6.7

_{Affected system
type}
SAP GUI / Frontend

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-29187] DLL Hijacking vulnerability in SapSetup (Software Installation Program)

Security Advisory

_{Related note}
3113349

_CVSS
3.7

_{Affected system
type}
ABAP

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-29110] Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard)

Security Advisory

_{Related note}
3115598

_CVSS
4.4

_{Affected system
type}
ABAP

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-29109] Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard)

Security Advisory

_{Related note}
3305907

_CVSS
8.7

_{Affected system
type}
ABAP

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-29186] Directory Traversal vulnerability in SAP NetWeaver ( BI CONT ADD ON)

Security Advisory

_{Related note}
3312733

_CVSS
6.8

_{Affected system
type}
Java

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-26458] Information Disclosure vulnerability in SAP Landscape Management

Security Advisory

_{Related note}
3114489

_CVSS
3.7

_{Affected system
type}
ABAP

_Patchday
2023-04

_{Released
on}
2023/04/11

Description
[CVE-2023-29112] Code Injection vulnerability in SAP Application Interface Framework (Message Monitoring)

Security Advisory

_{Related note}
3252433

_CVSS
9.9

_{Affected system
type}
Java

_Patchday
2023-03

_{Released
on}
2023/03/14

Description
[CVE-2023-23857] Improper Access Control in SAP NetWeaver AS for Java

Security Advisory

_{Related note}
3302162

_CVSS
9.6

_{Affected system
type}
ABAP

_Patchday
2023-03

_{Released
on}
2023/03/14

Description
[CVE-2023-27500] Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

Security Advisory

_{Related note}
3288096

_CVSS
5.3

_{Affected system
type}
Java

_Patchday
2023-03

_{Released
on}
2023/03/14

Description
[CVE-2023-26460] Improper Access Control in SAP NetWeaver AS Java (Cache Management Service)

Security Advisory

_{Related note}
3288480

_CVSS
5.3

_{Affected system
type}
Java

_Patchday
2023-03

_{Released
on}
2023/03/14

Description
[CVE-2023-27268] Improper Access Control in SAP NetWeaver AS Java (Object Analyzing Service)

Security Advisory

_{Related note}
3281484

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-03

_{Released
on}
2023/03/14

Description
[CVE-2023-26457] Cross-Site Scripting (XSS) vulnerability in SAP Content Server

Security Advisory

_{Related note}
3296328

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2023-03

_{Released
on}
2023/03/14

Description
[CVE-2023-27270] Denial of Service (DoS) in SAP NetWeaver AS for ABAP and ABAP Platform

Security Advisory

_{Related note}
3275727

_CVSS
7.2

_{Affected system
type}
SAP Host Agent

_Patchday
2023-03

_{Released
on}
2023/03/14

Description
[CVE-2023-27498] Memory Corruption vulnerability in SAPOSCOL

Security Advisory

_{Related note}
3302710

_CVSS
6.1

_{Affected system
type}
SAP Authenticator for Android

_Patchday
2023-03

_{Released
on}
2023/03/14

Description
[CVE-2023-27895] Information Disclosure vulnerability in SAP Authenticator for Android

Security Advisory

_{Related note}
3296476

_CVSS
8.8

_{Affected system
type}
ABAP

_Patchday
2023-03

_{Released
on}
2023/03/14

Description
[CVE-2023-27893] Arbitrary Code Execution in SAP Solution Manager and ABAP managed systems (ST-PI)

Security Advisory

_{Related note}
3294595

_CVSS
9.6

_{Affected system
type}
ABAP

_Patchday
2023-03

_{Released
on}
2023/03/14

Description
[CVE-2023-27269] Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

Security Advisory

_{Related note}
3284550

_CVSS
6.8

_{Affected system
type}
Java

_Patchday
2023-03

_{Released
on}
2023/03/14

Description
[CVE-2023-26461] XML External Entity (XXE) vulnerability in SAP NetWeaver (SAP Enterprise Portal)

Security Advisory

_{Related note}
3283438

_CVSS
9.0

_{Affected system
type}
BI/BO platform

_Patchday
2023-03

_{Released
on}
2023/03/14

Description
[CVE-2023-25617] OS Command Execution vulnerability in SAP Business Objects Business Intelligence Platform (Adaptive Job Server)

Security Advisory

_{Related note}
3245526

_CVSS
9.9

_{Affected system
type}
BI/BO platform

_Patchday
2023-03

_{Released
on}
2023/03/14

Description
[CVE-2023-25616] Code Injection vulnerability in SAP Business Objects Business Intelligence Platform (CMC)

Security Advisory

_{Related note}
3274920

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-03

_{Released
on}
2023/03/14

Description
[CVE-2023-0021] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver

Security Advisory

_{Related note}
3294954

_CVSS
8.7

_{Affected system
type}
ABAP

_Patchday
2023-03

_{Released
on}
2023/03/14

Description
[CVE-2023-27501] Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

Security Advisory

_{Related note}
3289844

_CVSS
6.8

_{Affected system
type}
ABAP

_Patchday
2023-03

_{Released
on}
2023/03/14

Description
[CVE-2023-25615] SQL Injection vulnerability in SAP ABAP Platform

Security Advisory

_{Related note}
3287120

_CVSS
6.5

_{Affected system
type}
BI/BO platform

_Patchday
2023-03

_{Released
on}
2023/03/14

Description
[Multiple CVEs] Multiple vulnerabilities in the SAP BusinessObjects Business Intelligence platform

Security Advisory

_{Related note}
3296346

_CVSS
7.4

_{Affected system
type}
ABAP

_Patchday
2023-03

_{Released
on}
2023/03/14

Description
[CVE-2023-26459] Multiple vulnerabilities in SAP NetWeaver AS for ABAP and ABAP Platform

Security Advisory

_{Related note}
3288394

_CVSS
5.3

_{Affected system
type}
Java

_Patchday
2023-03

_{Released
on}
2023/03/14

Description
[CVE-2023-24526] Improper Access Control in SAP NetWeaver AS Java (Classload Service)

Security Advisory

_{Related note}
3287291

_CVSS
3.8

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-23854] Missing Authorization check in SAP NetWeaver AS ABAP and ABAP Platform

Security Advisory

_{Related note}
3265846

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-0024] Cross Site Scripting in SAP Solution Manager (BSP Application)

Security Advisory

_{Related note}
3270509

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-23855] URL Redirection vulnerability in SAP Solution Manager

Security Advisory

_{Related note}
3256787

_CVSS
8.4

_{Affected system
type}
BI/BO platform

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-24530] Unrestricted Upload of File in SAP BusinessObjects Business Intelligence Platform (CMC)

Security Advisory

_{Related note}
3285757

_CVSS
8.8

_{Affected system
type}
SAP Host Agent

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-24523] Privilege Escalation vulnerability in SAP Host Agent (Start Service)

Security Advisory

_{Related note}
3271227

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-23853] URL Redirection vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

Security Advisory

_{Related note}
3293786

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-23858] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

Security Advisory

_{Related note}
3269118

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-24522] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (BSP Framework)

Security Advisory

_{Related note}
3269151

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-24521] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (BSP Framework)

Security Advisory

_{Related note}
3267442

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-0025] Cross Site Scripting in SAP Solution Manager (BSP Application)

Security Advisory

_{Related note}
3282663

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-24529] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (Business Server Pages application)

Security Advisory

_{Related note}
3268959

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[Multiple CVEs] Multiple vulnerabilities in SAP NetWeaver AS for ABAP and ABAP Platform

Security Advisory

_{Related note}
2985905

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-24524] Missing Authorization check in SAP S/4 HANA Map Treasury Correspondence Format Data

Security Advisory

_{Related note}
3263135

_CVSS
8.5

_{Affected system
type}
BI/BO platform

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-0020] Information disclosure vulnerability in SAP BusinessObjects Business Intelligence platform

Security Advisory

_{Related note}
2788178

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-24525] Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI

Security Advisory

_{Related note}
3290901

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-24528] Missing Authorization Check in SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests)

Security Advisory

_{Related note}
3274585

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-25614] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (BSP Framework)

Security Advisory

_{Related note}
3263863

_CVSS
4.3

_{Affected system
type}
BI/BO platform

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-23856] Cross-Site Scripting (XSS) vulnerability in Web Intelligence Interface

Security Advisory

_{Related note}
3275841

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-23851] Unrestricted File Upload in SAP Business Planning and Consolidation

Security Advisory

_{Related note}
3266751

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-23852] Cross-Site Scripting (XSS) vulnerability in SAP Solution Manager 7.2

Security Advisory

_{Related note}
3281724

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2023-02

_{Released
on}
2023/02/14

Description
[CVE-2023-0019] Missing Authorization check in SAP GRC (Process Control)

Security Advisory

_{Related note}
3262810

_CVSS
9.9

_{Affected system
type}
BI/BO platform

_Patchday
2023-01

_{Released
on}
2023/01/10

Description
[CVE-2023-0022] Code Injection vulnerability in SAP BusinessObjects Business Intelligence platform (Analysis edition for OLAP)

Security Advisory

_{Related note}
3089413

_CVSS
9.0

_{Affected system
type}
Kernel / ABAP

_Patchday
2023-01

_{Released
on}
2023/01/10

Description
[CVE-2023-0014] Capture-replay vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

Security Advisory

_{Related note}
3266006

_CVSS
5.4

_{Affected system
type}
BI/BO platform

_Patchday
2023-01

_{Released
on}
2023/01/10

Description
[CVE-2023-0018] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Central management console)

Security Advisory

_{Related note}
3276120

_CVSS
6.4

_{Affected system
type}
SAP Host Agent

_Patchday
2023-01

_{Released
on}
2023/01/10

Description
[CVE-2023-0012] Local Privilege Escalation in SAP Host Agent (Windows)

Security Advisory

_{Related note}
3268093

_CVSS
9.4

_{Affected system
type}
Java

_Patchday
2023-01

_{Released
on}
2023/01/10

Description
[CVE-2023-0017] Improper access control in SAP NetWeaver AS for Java

Security Advisory

_{Related note}
3283283

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2023-01

_{Released
on}
2023/01/10

Description
[CVE-2023-0013] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

Security Advisory

_{Related note}
3251447

_CVSS
4.6

_{Affected system
type}
BI/BO platform

_Patchday
2023-01

_{Released
on}
2023/01/10

Description
[CVE-2023-0015] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence (Web Intelligence)

Security Advisory

_{Related note}
3150704

_CVSS
4.5

_{Affected system
type}
ABAP

_Patchday
2023-01

_{Released
on}
2023/01/10

Description
[CVE-2023-0023] Information Disclosure in SAP Bank Account Management (Manage Banks)

Security Advisory

_{Related note}
3275391

_CVSS
9.9

_{Affected system
type}
SAP Business Planning...

_Patchday
2023-01

_{Released
on}
2023/01/10

Description
[CVE-2023-0016] SQL Injection vulnerability in SAP Business Planning and Consolidation MS

Security Advisory

Notifications

Security Advisories

Severity

SAP© Security advisories 150

System Types

Affected SAP© system types

Related note 3355658

CVSS 9.6

Affected system type SAP Business One

Patchday2023-11

Released on2023/11/14

Related note 3362849

CVSS 5.3

Affected system type Kernel

Patchday2023-11

Released on2023/11/14

Related note 3366410

CVSS 5.3

Affected system type Java

Patchday2023-11

Released on2023/11/14

Related note 3333426

CVSS 6.5

Affected system type Java

Patchday2023-10

Released on2023/10/26

Related note 3357154

CVSS 6.5

Affected system type SAP PowerDesigner

Patchday2023-10

Released on2023/10/10

Related note 3371873

CVSS 5.3

Affected system type Java

Patchday2023-10

Released on2023/10/10

Related note 3222121

CVSS 4.3

Affected system type ABAP

Patchday2023-10

Released on2023/10/10

Related note 3372991

CVSS 6.8

Affected system type BI/BO platform

Patchday2023-10

Released on2023/10/10

Related note 3338380

CVSS 4.3

Affected system type SAP Business One

Patchday2023-10

Released on2023/10/10

Related note 3323163

CVSS 5.5

Affected system type ABAP

Patchday2023-09

Released on2023/09/12

Related note 3326361

CVSS 5.4

Affected system type ABAP

Patchday2023-09

Released on2023/09/12

Related note 3352453

CVSS 5.3

Affected system type BI/BO platform

Patchday2023-09

Released on2023/09/12

Related note 3349805

CVSS 5.7

Affected system type Java

Patchday2023-09

Released on2023/09/12

Related note 3320355

CVSS 9.9

Affected system type SAP BI

Patchday2023-09

Released on2023/09/12

Related note 3355675

CVSS 2.7

Affected system type ABAP

Patchday2023-09

_{Related note}
3355658

_CVSS
9.6

_{Affected system
type}
SAP Business One

_Patchday
2023-11

_{Released
on}
2023/11/14

_{Related note}
3362849

_CVSS
5.3

_{Affected system
type}
Kernel

_Patchday
2023-11

_{Released
on}
2023/11/14

_{Related note}
3366410

_CVSS
5.3

_{Affected system
type}
Java

_Patchday
2023-11

_{Released
on}
2023/11/14

_{Related note}
3333426

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2023-10

_{Released
on}
2023/10/26

_{Related note}
3357154

_CVSS
6.5

_{Affected system
type}
SAP PowerDesigner

_Patchday
2023-10

_{Released
on}
2023/10/10

_{Related note}
3371873

_CVSS
5.3

_{Affected system
type}
Java

_Patchday
2023-10

_{Released
on}
2023/10/10

_{Related note}
3222121

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2023-10

_{Released
on}
2023/10/10

_{Related note}
3372991

_CVSS
6.8

_{Affected system
type}
BI/BO platform

_Patchday
2023-10

_{Released
on}
2023/10/10

_{Related note}
3338380

_CVSS
4.3

_{Affected system
type}
SAP Business One

_Patchday
2023-10

_{Released
on}
2023/10/10

_{Related note}
3323163

_CVSS
5.5

_{Affected system
type}
ABAP

_Patchday
2023-09

_{Released
on}
2023/09/12

_{Related note}
3326361

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2023-09

_{Released
on}
2023/09/12

_{Related note}
3352453

_CVSS
5.3

_{Affected system
type}
BI/BO platform

_Patchday
2023-09

_{Released
on}
2023/09/12

_{Related note}
3349805

_CVSS
5.7

_{Affected system
type}
Java

_Patchday
2023-09

_{Released
on}
2023/09/12

_{Related note}
3320355

_CVSS
9.9

_{Affected system
type}
SAP BI

_Patchday
2023-09

_{Released
on}
2023/09/12

_{Related note}
3355675

_CVSS
2.7

_{Affected system
type}
ABAP

_Patchday
2023-09

_{Released
on}
2023/09/12

_{Related note}
3357163

_CVSS
6.3

_{Affected system
type}
PowerDesigner

_Patchday
2023-09

_{Released
on}
2023/09/12