SAP Security Patch Day, January 2023: the CVEs

SAP Security Patch Day January 2023: the CVEs SAP published on 10 January 2023, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: Dec 2022, Nov 2022, Oct 2022, Sep 2022, Aug 2022, Jul 2022, Jun 2022, May 2022, Apr 2022, Mar 2022, Feb 2022, Jan 2022. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

1. 5.7CVE-2023-0023EPSS 0.5%2023-01-10

   In SAP Bank Account Management (Manage Banks) application, when a user clicks a smart link to navigate to another app, personal data is shown directly in the URL. They might get captured in log files, bookmarks, and so on disclosing sensit…

2. 8.8CVE-2023-0022EPSS 0.8%2023-01-10

   SAP BusinessObjects Business Intelligence Analysis edition for OLAP allows an authenticated attacker to inject malicious code that can be executed by the application over the network. On successful exploitation, an attacker can perform ope…

3. 6.1CVE-2023-0018EPSS 0.6%2023-01-10

   Due to improper input sanitization of user-controlled input in SAP BusinessObjects Business Intelligence Platform CMC application - versions 420, and 430, an attacker with basic user-level privileges can modify/upload crystal reports conta…

4. 9.8CVE-2023-0017EPSS 16%2023-01-10

   An unauthenticated attacker in SAP NetWeaver AS for Java - version 7.50, due to improper access control, can attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unaut…

5. 8.8CVE-2023-0016EPSS 0.7%2023-01-10

   SAP BPC MS 10.0 - version 810, allows an unauthorized attacker to execute crafted database queries. The exploitation of this issue could lead to SQL injection vulnerability and could allow an attacker to access, modify, and/or delete data …

6. 5.4CVE-2023-0015EPSS 0.4%2023-01-10

   In SAP BusinessObjects Business Intelligence Platform (Web Intelligence user interface) - version 420, some calls return json with wrong content type in the header of the response. As a result, a custom application that calls directly the …

7. 9.8CVE-2023-0014EPSS 0.7%2023-01-10

   SAP NetWeaver ABAP Server and ABAP Platform - versions SAP_BASIS 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, KERNEL 7.22, 7.53, 7.77, 7.81, 7.85, 7.89, KRNL64UC 7.22, 7.22EXT, 7.53, KRNL64NUC 7.22, 7.22E…

8. 6.1CVE-2023-0013EPSS 0.4%2023-01-10

   The ABAP Keyword Documentation of SAP NetWeaver Application Server - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, for ABAP and ABAP Platform does not sufficiently encode user-controlled inputs, resulting in Cross-Site Sc…

9. 6.7CVE-2023-0012EPSS 0.2%2023-01-10

   In SAP Host Agent (Windows) - versions 7.21, 7.22, an attacker who gains local membership to SAP_LocalAdmin could be able to replace executables with a malicious file that will be started under a privileged account. Note that by default al…