SAP provided security fixes for 19 vulnerabilities, five of which were classified as critical, affecting SAP Business Objects Business Intelligence Platform (CMC) and SAP NetWeaver. To reduce the dangers involved, the administrators should apply the patch immediately.
The company has released security patches to address vulnerabilities in the SAP Business Objects Business Intelligence Platform (CMC) and SAP NetWeaver Application Server (CVE-2023-25616, CVE-2023-23857, CVE-2023-27269, CVE-2023-27500, and CVE-2023-25617).
Also, SAP’s monthly security patch addressed four high-severity issues and ten medium-severity vulnerabilities.
Specifics of the Five Issues That Were Fixed
- CVE-2023-25616:
A code injection vulnerability in the SAP Business Intelligence Platform with a critical severity (CVSS v3: 9.9) that allows an attacker to access resources only accessible to privileged users. Versions 420 and 430 are affected by the bug.
- CVE-2023-23857:
Critical severity (CVSS v3: 9.8) information disclosure, data manipulation, and DoS bug affecting SAP NetWeaver AS for Java, version 7.50. By attaching to an open interface and gaining access to services via the directory API, the flaw enables an unauthenticated attacker to carry out unauthorized actions.
- CVE-2023-27269:
Directory traversal issue with critical severity (CVSS v3: 9.6) affecting SAP NetWeaver Application Server for ABAP. A non-admin user can overwrite system files due to a bug. Versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, and 791 are affected.
- CVE-2023-27500:
Directory traversal with a critical severity (CVSS v3: 9.6) in SAP NetWeaver AS for ABAP. By utilizing the SAPRSBRO bug to overwrite system files, an attacker can harm the susceptible endpoint. Version 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, and 757 are affected.
- CVE-2023-25617:
Command execution vulnerability in SAP Business Objects Business Intelligence Platform, versions 420 and 430, with Critical severity (CVSS v3: 9.0). In certain circumstances, the vulnerability enables a remote attacker to execute arbitrary commands on the OS using the BI Launchpad, Central Management Console, or a customized application built using the public Java SDK.
Recommendation:
“SAP strongly recommends that the customer visits the Support Portal and applies patches on priority to protect their SAP landscape,” says the company.
Because SAP’s products are used by large companies around the world and can serve as access points to valuable systems, they are a good target for threat actors.
Users and administrators of the affected SAP products are urged to update to the latest versions immediately.
Network Security Checklist – Download Free E-Book