Skip to content
OpenAdvisories
High WID-SEC-2023-1437 12 CVEs

SAP Patchday Juni 2023

Published Jun 12, 2023 · Updated Jun 12, 2023 · de-DE

Vendor: SAP Product: Software

Summary

Ein Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu verursachen, Daten zu manipulieren und einen Cross-Site-Scripting-Angriff durchzuführen.

Product

SAP stellt unternehmensweite Lösungen für Geschäftsprozesse wie Buchführung, Vertrieb, Einkauf und Lagerhaltung zur Verfügung.

Vulnerabilities 12

  • High 8.2
    CVE-2023-33991

    Stored Cross-Site Scripting (Stored XSS) vulnerability in SAP UI5 Variant Management

    SAP UI5 Variant Management - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200, does not sufficiently encode user-controlled inputs on reading data from the server, resulting in Stored Cross-Site Scripting (Stored XSS) vulnerabil…

    SAP SAP UI5 Variant Management
  • High 7.9
    CVE-2023-2827

    Missing Authentication in SAP Plant Connectivity and Production Connector for SAP Digital

    SAP Plant Connectivity - version 15.5 (PCo) or the Production Connector for SAP Digital Manufacturing - version 1.0, do not validate the signature of the JSON Web Token (JWT) in the HTTP request sent from SAP Digital Manufacturing. Therefore, unauthorized cal…

    SAP SAP Plant Connectivity
  • High 7.1
    CVE-2023-30743

    Improper Neutralization of Input in SAPUI5

    Due to improper neutralization of input in SAPUI5 - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200, sap.m.FormattedText SAPUI5 control allows injection of untrusted CSS. This blocks user’s interaction with the application. Fur…

    SAP SAPUI5
  • Medium 6.4
    CVE-2023-33984

    Cross-Site Scripting (XSS) vulnerability in NetWeaver (Design Time Repository)

    SAP NetWeaver (Design Time Repository) - version 7.50, returns an unfavorable content type for some versioned files, which could allow an authorized attacker to create a file with a malicious content and send a link to a victim in an email or instant message.…

    SAP SAP NetWeaver (Design Time Repository)
  • Medium 6.1
    CVE-2023-30742

    Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)

    SAP CRM (WebClient UI) - versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 700, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, re…

    SAP SAP CRM (WebClient UI)
  • Medium 6.1
    CVE-2023-31406

    Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform

    Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect users to untrusted site using a malicious link. On successful exploitation, an attacker can view or mo…

    SAP SAP BusinessObjects Business Intelligence Platform
  • Medium 6.1
    CVE-2023-33985

    Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal

    SAP NetWeaver Enterprise Portal - version 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability, therefore changing the scope of the attack. On successful exploitation, an a…

    SAP SAP NetWeaver Enterprise Portal
  • Medium 6.1
    CVE-2023-33986

    Cross-Site Scripting (XSS) vulnerability in SAP CRM ABAP (Grantor Management)

    SAP CRM ABAP (Grantor Management) - versions 700, 701, 702, 712, 713, 714, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause limited impact on confi…

    SAP SAP CRM ABAP (Grantor Management)
  • Medium 4.2
    CVE-2023-32115

    SQL Injection in Master Data Synchronization (MDS COMPARE TOOL)

    An attacker can exploit MDS COMPARE TOOL and use specially crafted inputs to read and modify database commands, resulting in the retrieval of additional information persisted by the system.

    SAP Master Data Synchronization (MDS COMPARE TOOL)
  • Low 2.7
    CVE-2023-32114

    Denial of Service in SAP NetWeaver

    SAP NetWeaver (Change and Transport System) - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privileges to maliciously run a benchmark program repeatedly in intent to slowdown or make the server unavail…

    SAP SAP NetWeaver (Change and Transport System)
  • Unscored —
    CVE-2021-42063 Public exploit Scanner template EPSS 23%

    A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50. The usag…

    SAP SAP Knowledge Warehouse
  • Unscored —
    CVE-2022-22542

    S/4HANA Supplier Factsheet exposes the private address and bank details of an Employee Business Partner with Supplier R…

    SAP SAP S/4HANA (Supplier Factsheet and Enterprise Search for Business Partner, Supplier and Customer)

Revision history

  1. #1

    Initiale Fassung

References