SAP Security Patch Day — January 2023

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 5

• Critical 10.0
  CVE-2023-0018 Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Central management console)
• Critical 9.9
  CVE-2023-0016 SQL Injection vulnerability in SAP Business Planning and Consolidation MS
• Critical 9.9
  CVE-2023-0022 Code Injection vulnerability in SAP BusinessObjects Business Intelligence platform (Analysis edition for OLAP)
• Critical 9.4
  CVE-2023-0017 Improper access control in SAP NetWeaver AS for Java
  EPSS 16%
• Critical 9.0
  CVE-2023-0014 Capture-replay vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

All vulnerabilities 9