German business software maker SAP on Tuesday announced the release of 13 new and five updated security notes as part of its September 2023 Security Patch Day.
Five of the SAP security notes released this month are rated ‘hot news’, the company’s highest rating. Three of them, however, are updates for previously released security notes.
The most severe of the new hot news notes addresses a critical vulnerability in BusinessObjects (CVE-2023-40622, CVSS score of 9.9), allowing attackers to access information that could be used in other attacks, potentially leading to complete application compromise.
The issue, enterprise application security firm Onapsis explains, impacts the job folder of the Promotion Management component.
As a workaround, organizations should provide only required users with the necessary rights to access and perform promotions, and should deny administrators the view rights on the Promotion jobs folder.
The second new hot news security note SAP released this month addresses a missing authorization check issue in CommonCryptoLib. Tracked as CVE-2023-40309 (CVSS score of 9.8), the bug impacts multiple SAP products, including NetWeaver, S/4HANA, Web Dispatcher, Content Server, Host Agent, and Extended Application Services and Runtime (XSA).
“Missing or wrong authorization checks in SAP CommonCryptoLib can result in an escalation of privileges. The resulting impact depends on the application and on the level of acquired privileges. In the worst case, attackers can compromise the affected application completely,” Onapsis explains.
This month, SAP has updated hot news security notes addressing vulnerabilities in the Chromium browser in Business Client (the update fixes 67 vulnerabilities), a code injection flaw in BusinessObjects, and an improper access control issue in NetWeaver (the note was previously deleted by accident).
On Tuesday, SAP also announced the release of two new high-priority security notes that address an insufficient file type validation flaw in BusinessObjects (CVE-2023-42472), and a memory corruption bug in CommonCryptoLib (CVE-2023-40308 – the patches for CVE-2023-40309 automatically patch this issue as well).
The remaining security notes address medium- and low-severity vulnerabilities in PowerDesignerClient, BusinessObjects Suite, S/4HANA, SAPUI5, Quotation Management Insurance, NetWeave, and S4CORE.
“With eighteen new and updated SAP Security Notes, including five HotNews Notes and two High Priority Notes, SAP’s September Patch Day seems to be a busy one. But since two HotNews Notes are only minor updates that do not require customer actions and not much effort is needed to implement SAP BusinessObjects and SAPCryptoLib notes, the patching effort is manageable,” Onapsis points out.
Reated: SAP Patches Critical Vulnerability in PowerDesigner Product
Reated: SAP Patches Critical Vulnerability in ECC and S/4HANA Products
Reated: SAP Patches High-Severity Vulnerabilities With June 2023 Security Updates
More from Ionut Arghire
- Generative AI Startup Nexusflow Raises $10.6 Million
- Researchers Extract Sounds From Still Images on Smartphone Cameras
- Hackers Set Sights on Apache NiFi Flaw That Exposes Many Organizations to Attacks
- Cloudflare Users Exposed to Attacks Launched From Within Cloudflare: Researchers
- FBI Warns Organizations of Dual Ransomware, Wiper Attacks
- Lumu Raises $30 Million for Threat Detection and Response Platform
- Cisco Warns of IOS Software Zero-Day Exploitation Attempts
- Russian Zero-Day Acquisition Firm Offers $20 Million for Android, iOS Exploits
Latest News
- Bankrupt IronNet Shuts Down Operations
- AWS Using MadPot Decoy System to Disrupt APTs, Botnets
- Generative AI Startup Nexusflow Raises $10.6 Million
- In Other News: RSA Encryption Attack, Meta AI Privacy, ShinyHunters Hacker Guilty Plea
- Researchers Extract Sounds From Still Images on Smartphone Cameras
- National Security Agency is Starting an Artificial Intelligence Security Center
- CISA Warns of Old JBoss RichFaces Vulnerability Being Exploited in Attacks
- Hackers Set Sights on Apache NiFi Flaw That Exposes Many Organizations to Attacks
