Security Advisories  

We've created the first of its kind, SecurityBridge Cloud Platform to prioritize SAP patches, updates and the remediation strategies essential for preventing the disruption of vital business systems. Our security advisories enable SAP users to understand the security and business implications of running SAP.

The user interface, is designed to be as intuitive as possible but we'd love to hear your feedback and opinions.
We hope you like it!
× Yikes, there is work to do!
This time we found critical correction advisiories. We count 15 and the highest CVSS score is 9.1.

 

 Severity
SAP© Security advisories 15
 System Types
Affected SAP© system types

 

Related note
3392547
CVSS
4.1

Affected system type
ABAP
Patchday
2023-12
Released on
2023/12/12

Description
[CVE-2023-49581] SQL Injection vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform

 

Related note
3394567
CVSS
8.1

Affected system type
SAP Commerce
Patchday
2023-12
Released on
2023/12/12

Description
[CVE-2023-42481] Improper Access Control vulnerability in SAP Commerce Cloud

 

Related note
3399691
CVSS
9.1

Affected system type
ABAP
Patchday
2023-12
Released on
2023/12/12

Description
Update 1 to 3350297 - [CVE-2023-36922] OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL)

 

Related note
3217087
CVSS
6.1

Affected system type
ABAP
Patchday
2023-12
Released on
2023/12/12

Description
[CVE-2023-49577] Cross-Site Scripting (XSS) vulnerability in the SAP HCM (SMART PAYE solution)

 

Related note
3363690
CVSS
3.5

Affected system type
ABAP
Patchday
2023-12
Released on
2023/12/12

Description
[CVE-2023-49058] Directory Traversal vulnerability in SAP Master Data Governance

 

Related note
3411067
CVSS
9.1

Affected system type
BTP
Patchday
2023-12
Released on
2023/12/12

Description
[Multiple CVEs] Escalation of Privileges in SAP Business Technology Platform (BTP) Security Services Integration Libraries

 

Related note
3406786
CVSS
4.3

Affected system type
SAP UI5
Patchday
2023-12
Released on
2023/12/12

Description
[CVE-2023-49584] Client-Side Desynchronization vulnerability in SAP Fiori Launchpad

 

Related note
3395306
CVSS
6.4

Affected system type
ABAP
Patchday
2023-12
Released on
2023/12/12

Description
[CVE-2023-49587] Command Injection vulnerability in SAP Solution Manager

 

Related note
3362463
CVSS
3.5

Affected system type
SAP Cloud Connector
Patchday
2023-12
Released on
2023/12/12

Description
[CVE-2023-49578] Denial of service (DOS) in SAP Cloud Connector

 

Related note
3159329
CVSS
5.3

Affected system type
ABAP
Patchday
2023-12
Released on
2023/12/12

Description
Denial of service (DoS) vulnerability in JSZip library bundled within SAPUI5

 

Related note
3385711
CVSS
7.3

Affected system type
SAP GUI / Frontend
Patchday
2023-12
Released on
2023/12/12

Description
[CVE-2023-49580] Information disclosure vulnerability in SAP GUI for WIndows and SAP GUI for Java

 

Related note
3383321
CVSS
6.1

Affected system type
Java
Patchday
2023-12
Released on
2023/12/12

Description
[CVE-2023-42479] Cross-Site Scripting (XSS) vulnerability in SAP Biller Direct

 

Related note
3406244
CVSS
7.1

Affected system type
Android SDK
Patchday
2023-12
Released on
2023/12/12

Description
[CVE-2023-6542] Missing Authorization Check in SAP EMARSYS SDK ANDROID

 

Related note
3369353
CVSS
6.8

Affected system type
BI/BO platform
Patchday
2023-12
Released on
2023/12/12

Description
[CVE-2023-42476] Cross Site Scripting vulnerability in SAP BusinessObjects Web Intelligence

 

Related note
3382353
CVSS
7.5

Affected system type
BI/BO platform
Patchday
2023-12
Released on
2023/12/12

Description
[CVE-2023-42478] Cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform

 

 
ABEX logo

SecurityBridge helps in prioritizing SAP patches, updates and the remediation strategies essential for preventing the disruption of vital business systems. We help businesses in making their SAP systems more secure.

SecurityBridge

© Copyright 2024 by SecurityBridge GmbH

v34.1