Skip to content
OpenAdvisories
High WID-SEC-2023-3103 18 CVEs

SAP Software: Mehrere Schwachstellen

Published Dec 11, 2023 · Updated Dec 11, 2023 · de-DE

Vendor: SAP Product: Software Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen um seine Privilegien zu erhöhen, Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren und einen Cross-Site-Scripting-Angriff durchzuführen.

Product

SAP stellt unternehmensweite Lösungen für Geschäftsprozesse wie Buchführung, Vertrieb, Einkauf und Lagerhaltung zur Verfügung.

Vulnerabilities 18

  • Critical 9.1
    CVE-2023-36922

    OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL)

    Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension.  On successful …

    SAP SAP ECC and SAP S/4HANA (IS-OIL)
  • Critical 9.1
    CVE-2023-49583

    Escalation of Privileges in SAP BTP Security Services Integration Library ([Node.js] @sap/xssec)

    SAP BTP Security Services Integration Library ([Node.js] @sap/xssec - versions < 3.6.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.

    SAP @sap/xssec @sap/xssec npm
  • Critical 9.1
    CVE-2023-50422

    Escalation of Privileges in SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library)

    SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3.3.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unau…

    SAP cloud-security-services-integration-library com.sap.cloud.security:spring-security github.com/sap/cloud-security-client-go Maven Go
  • Critical 9.1
    CVE-2023-50423

    Escalation of Privileges in SAP BTP Security Services Integration Library ([Python] cloud-pysec)

    SAP BTP Security Services Integration Library ([Python] sap-xssec) - versions < 4.1.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.

    SAP @sap/xssec sap-xssec PyPI
  • Critical 9.1
    CVE-2023-50424

    Escalation of Privileges in SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go)

    SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go) - versions < 0.17.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary perm…

    SAP github.com/sap/cloud-security-client-go
  • High 8.1
    CVE-2023-42481

    Improper Access Control vulnerability in SAP Commerce Cloud

    In SAP Commerce Cloud - versions HY_COM 1905, HY_COM 2005, HY_COM2105, HY_COM 2011, HY_COM 2205, COM_CLOUD 2211, a locked B2B user can misuse the forgotten password functionality to un-block his user account again and re-gain access if SAP Commerce Cloud - Co…

    SAP SAP Commerce Cloud
  • High 7.5
    CVE-2023-42478

    Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform

    SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to upload agnostic documents in the system which when opened by any other user could lead to high impact on integrity of the application.

    SAP Business Objects BI Platform
  • High 7.3
    CVE-2023-49580

    Information disclosure in SAP GUI for Windows and SAP GUI for Java

    SAP GUI for Windows and SAP GUI for Java - versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addition, this vulnerability allow…

    SAP SAP GUI for Windows and SAP GUI for Java Windows
  • High 7.1
    CVE-2023-6542

    Improper Export of Android Application Components in SAP EMARSYS SDK ANDROID

    Due to lack of proper authorization checks in Emarsys SDK for Android, an attacker can call a particular activity and can forward himself web pages and/or deep links without any validation directly from the host application. On successful attack, an attacker …

    SAP SAP EMARSYS SDK ANDROID Android
  • Medium 6.8
    CVE-2023-42476

    Cross Site Scripting vulnerability in SAP BusinessObjects Web Intelligence

    SAP Business Objects Web Intelligence - version 420, allows an authenticated attacker to inject JavaScript code into Web Intelligence documents which is then executed in the victim’s browser each time the vulnerable page is visited. Successful exploitation ca…

    SAP SAP BusinessObjects Web Intelligence
  • Medium 6.4
    CVE-2023-49587

    Command Injection vulnerability in SAP Solution Manager

    SAP Solution Manager - version 720, allows an authorized attacker to execute certain deprecated function modules which can read or modify data of same or other component without user interaction over the network.

    SAP SAP Solution Manager
  • Medium 6.1
    CVE-2023-42479

    Cross-Site Scripting (XSS) vulnerability in SAP Biller Direct

    An unauthenticated attacker can embed a hidden access to a Biller Direct URL in a frame which, when loaded by the user, will submit a cross-site scripting request to the Biller Direct system. This can result in the disclosure or modification of non-sensitive …

    SAP SAP Biller Direct
  • Medium 6.1
    CVE-2023-49577

    Cross-Site Scripting (XSS) vulnerability in the SAP HCM (SMART PAYE solution)

    The SAP HCM (SMART PAYE solution) - versions S4HCMCIE 100, SAP_HRCIE 600, SAP_HRCIE 604, SAP_HRCIE 608, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can …

    SAP SAP HCM (SMART PAYE solution)
  • Medium 5.3
    CVE-2021-23413

    Denial of Service (DoS)

    This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance.

    jszip node-jszip node-jszip Debian Ubuntu npm
  • Medium 4.3
    CVE-2023-49584

    Client-Side Desynchronization vulnerability in SAP Fiori Launchpad

    SAP Fiori launchpad - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, UI_700 200, SAP_BASIS 793, allows an attacker to use HTTP verb POST on read-only service causing low impact on Confidentiality of the application.

    SAP SAP Fiori Launchpad
  • Medium 4.1
    CVE-2023-49581

    SQL Injection vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform

    SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addition, this vulnerability allows the unauthenticated attacker to write data to a database table. By do…

    SAP SAP NetWeaver Application Server ABAP and ABAP Platform
  • Low 3.5
    CVE-2023-49058

    Directory Traversal vulnerability in SAP Master Data Governance

    SAP Master Data Governance File Upload application allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing ‘traverse to parent directory’ are passed through to the file APIs. As a result, it ha…

    SAP SAP Master Data Governance
  • Low 3.5
    CVE-2023-49578

    Denial of service (DOS) in SAP Cloud Connector

    SAP Cloud Connector - version 2.0, allows an authenticated user with low privilege to perform Denial of service attack from adjacent UI by sending a malicious request which leads to low impact on the availability and no impact on confidentiality or Integrity …

    SAP SAP Cloud Connector

Revision history

  1. #1

    Initiale Fassung

References