SAP Releases February 2023 Security Updates

Scheduled security updates address vulnerabilities affecting multiple products

Threat ID:: CC-4265
Threat Severity:: Information only
Published:: 15 February 2023 3:33 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Scheduled security updates address vulnerabilities affecting multiple products

Affected platforms

The following platforms are known to be affected:

SAP Business Client

SAP BusinessObjects Business Intelligence Platform

The following platforms are also known to be affected:

SAP Host Agent Service
SAP Business Planning and Consolidation
SAP BusinessObjects Business Intelligence platform
SAP NetWeaver AS
SAP Customer Relationship Management (CRM)

Threat details

Introduction

SAP has released security updates to address multiple vulnerabilities, which are covered in seventeen new security notes and four updates to previous notes. Three of these vulnerabilities are rated High and involve issues such as privilege escalation, cross site scripting (XSS), and improper access control. An attacker could exploit some of these vulnerabilities to take control of an affected system.

Remediation advice

Affected organisations are encouraged to review the SAP Security Notes for February 2023 and apply the necessary updates.

Definitive source of threat updates

https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a&rc=10

CVE Vulnerabilities

Status Published

CVE-2023-24523

An attacker authenticated as a non-admin user with local access to a server port assigned to the SAP Host Agent (Start Service) - versions 7.21, 7.22, can submit a crafted ConfigureOutsideDiscovery request with an operating system command which will be executed with administrator privileges. The OS command can read or modify any user or system data and can make the system unavailable.

Status Published

CVE-2023-0020

SAP BusinessObjects Business Intelligence platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise restricted. On successful exploitation, there could be a high impact on confidentiality and limited impact on integrity of the application.

Status Published

CVE-2023-24530

SAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an authenticated admin user to upload malicious code that can be executed by the application over the network. On successful exploitation, attacker can perform operations that may completely compromise the application causing high impact on confidentiality, integrity and availability of the application.

Last edited: 15 February 2023 3:33 pm