Skip to main content

SAP Releases April 2023 Security Updates

Scheduled security updates address vulnerabilities affecting multiple products

Threat ID:
CC-4297
Threat Severity:
Information only
Published:
11 April 2023 1:28 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Scheduled security updates address vulnerabilities affecting multiple products

The following platforms are also known to be affected:

  • SAP Diagnostics Agent
  • SAP GUI for HTML
  • SAP Customer Relationship Manager (CRM)
  • SAP Web Dispatcher and Internet Communication Manager
  • SAP Commerce
  • SAP Application Interface Framework

Threat details

Introduction

SAP has released security updates to address multiple vulnerabilities, which are covered in nineteen new security notes and five updates to previous notes. Five of these vulnerabilities are rated as critical and one vulnerability is rated as high. An attacker could exploit some of these vulnerabilities to perform remote code execution, cross site scripting (XSS), denial-of-service, or other malicious activity.

Remediation advice

Affected organisations are encouraged to review the SAP Security Notes for April 2023 and apply the necessary updates.

CVE Vulnerabilities

Status Published

CVE-2022-41272

An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search (UDS) of SAP NetWeaver Process Integration (PI) - version 7.50 and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and data across the entire system. This allows the attacker to have full read access to user data, make limited modifications to user data, and degrade the performance of the system, leading to a high impact on confidentiality and a limited impact on the availability and integrity of the application.
Status Published

CVE-2023-27497

Due to missing authentication and input sanitization of code the EventLogServiceCollector of SAP Diagnostics Agent - version 720, allows an attacker to execute malicious scripts on all connected Diagnostics Agents running on Windows. On successful exploitation, the attacker can completely compromise confidentiality, integrity and availability of the system.
Status Published

CVE-2023-28765

An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, can get access to lcmbiar file and further decrypt the file. After this attacker can gain access to BI user’s passwords and depending on the privileges of the BI user, the attacker can perform operations that can completely compromise the application.
Status Published

CVE-2023-27269

SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker with non-administrative authorizations to exploit a directory traversal flaw in an available service to overwrite the system files. In this attack, no data can be read but potentially critical OS files can be overwritten making the system unavailable.
Status Published

CVE-2023-29186

SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker with non-administrative authorizations to exploit a directory traversal flaw in an available service to overwrite the system files. In this attack, no data can be read but potentially critical OS files can be overwritten making the system unavailable.

Last edited: 11 April 2023 1:28 pm