DeutschShown in its original language — a full translation is planned for a future version.
SAP Patchday Oktober 2023
view advisory published 2023-10-09
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren und einen Cross-Site-Scripting-Angriff durchzuführen.
01
describes (7)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-42477US | medium6.5 | — | ||
SAP NetWeaver AS Java (GRMG Heartbeat application) - version 7.50, allows an attacker to send a crafted request from a vulnerable web application, causing limited impact on confide… | ||||
| CVE-2023-42475US | medium4.3 | — | ||
The Statutory Reporting application has a vulnerable file storage location, potentially enabling low privileged attacker to read server files with minimal impact on confidentiality… | ||||
| CVE-2023-42474US | medium5.4 | — | ||
SAP BusinessObjects Web Intelligence - version 420, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link to a user that would p… | ||||
| CVE-2023-42473US | medium5.4OT elevated | — | ||
S/4HANA Manage (Withholding Tax Items) - version 106, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges which has low… | ||||
| CVE-2023-41365US | medium4.3 | — | ||
SAP Business One (B1i) - version 10.0, allows an authorized attacker to retrieve the details stack trace of the fault message to conduct the XXE injection, which will lead to infor… | ||||
| CVE-2023-40310US | high7.5 | — | ||
SAP PowerDesigner Client - version 16.7, does not sufficiently validate BPMN2 XML document imported from an untrusted source. As a result, URLs of external entities in BPMN2 file,… | ||||
| CVE-2023-31405US | medium5.3 | — | ||
SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network which can result in unw… | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan