Skip to content
OpenAdvisories
High WID-SEC-2023-2600 7 CVEs

SAP Patchday Oktober 2023

Published Oct 9, 2023 · Updated Oct 9, 2023 · de-DE

Vendor: SAP Product: Software Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren und einen Cross-Site-Scripting-Angriff durchzuführen.

Product

SAP stellt unternehmensweite Lösungen für Geschäftsprozesse wie Buchführung, Vertrieb, Einkauf und Lagerhaltung zur Verfügung.

Vulnerabilities 7

  • Medium 6.8
    CVE-2023-42474

    Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Web Intelligence

    SAP BusinessObjects Web Intelligence - version 420, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link to a user that would possibly allow an attacker to retrieve the sensitive information.

    SAP SAP BusinessObjects Web Intelligence
  • Medium 6.5
    CVE-2023-40310

    Missing XML Validation vulnerability in SAP PowerDesigner Client BPMN2 import

    SAP PowerDesigner Client - version 16.7, does not sufficiently validate BPMN2 XML document imported from an untrusted source. As a result, URLs of external entities in BPMN2 file, although not used, would be accessed during import. A successful attack could i…

    SAP SAP PowerDesigner Client
  • Medium 6.5
    CVE-2023-42477

    Server-Side Request Forgery in SAP NetWeaver AS Java (GRMG Heartbeat application)

    SAP NetWeaver AS Java (GRMG Heartbeat application) - version 7.50, allows an attacker to send a crafted request from a vulnerable web application, causing limited impact on confidentiality and integrity of the application.

    SAP SAP NetWeaver AS Java
  • Medium 5.4
    CVE-2023-42473

    Missing Authorization Check In S/4HANA (Manage Withholding Tax Items)

    S/4HANA Manage (Withholding Tax Items) - version 106, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges which has low impact on the confidentiality and integrity of the application.

    SAP S/4HANA (Manage Withholding Tax Items)
  • Medium 5.3
    CVE-2023-31405

    Log Injection vulnerability in SAP NetWeaver AS for Java (Log Viewer)

    SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network which can result in unwarranted modifications to a system log without user interaction. There is no ab…

    SAP SAP NetWeaver AS for Java (Log Viewer)
  • Medium 4.3
    CVE-2023-41365

    Information Disclosure vulnerability in SAP Business One (B1i)

    SAP Business One (B1i) - version 10.0, allows an authorized attacker to retrieve the details stack trace of the fault message to conduct the XXE injection, which will lead to information disclosure. After successful exploitation, an attacker can cause limited…

    SAP SAP Business One (B1i)
  • Medium 4.3
    CVE-2023-42475

    Information Disclosure Vulnerability in Statutory Reporting

    The Statutory Reporting application has a vulnerable file storage location, potentially enabling low privileged attacker to read server files with minimal impact on confidentiality.

    SAP SAP S/4Hana Core

Revision history

  1. #1

    Initiale Fassung

References