The February SAP Patch Day is the moment when the IT industry watches the latest SAP security updates with bated breath. This year was no exception, and February brought us as many as twenty-six new and updated security notes, including one HotNews note and five high-priority notes. For SAP specialists such as ourselves at SNOK, this is a key moment to ensure that our clients’ systems are protected against the latest threats.
What’s new in February?
Among the releases was a HotNews note concerning SAP Business Client, which patched fifty-four vulnerabilities in Chromium, including twenty-two high-priority patches. The highest CVSS score among all patched vulnerabilities was 8.8, which shows how serious these threats can be.
However, that’s not all. Two of the five high-priority notes are updated versions of previously released notes, which first appeared in December. They concern, among others, SAP Host Agent and SAP Business Planning and Consolidation, where the most serious vulnerability allowed the execution of arbitrary operating system commands with administrator privileges.
Details of new high-priority notes
Among the new high-priority notes was one concerning SAP Host Agent. This vulnerability allowed an unauthorised user with local access to the server port assigned to the SAP Host Agent service to send a specially crafted web service request containing an arbitrary operating system command, which was executed with administrator privileges. This is a serious threat to the confidentiality, integrity, and availability of the system.
Why does this matter to SNOK and our clients?
As a Gold SAP partner, we at SNOK fully understand the importance of maintaining the highest level of security for our clients’ systems. The February SAP Patch Day is a reminder of the ongoing need to monitor and update systems in order to protect against new and evolving threats.
How does SNOK help clients manage patches?
At SNOK we offer comprehensive services in SAP BASIS, SAP analysis, cybersecurity and SAP penetration testing, as well as trusted advisory in these areas. Our experience and partnerships allow us not only to track the latest SAP security updates, but also to effectively manage and implement these updates in our clients’ systems.
Summary
The February SAP Patch Day brought a range of important updates aimed at protecting SAP systems against the latest threats. At SNOK we ensure that our services and solutions are always up to date with security best practices, so that our clients can focus on their business, knowing their systems are secure.
In today’s world, where cyber threats evolve day by day, the importance of regular security updates cannot be overstated.
We encourage all SAP administrators to regularly monitor SAP Patch Day releases and implement the recommended updates. Remember that system security is a process, not a one-off action. At SNOK we are here to support you in this process, offering our knowledge, experience, and dedicated services.
Appendix - detailed notes from the February SAP Patch Day
| SAP Note | Type | Description | Priority | CVSS |
|---|---|---|---|---|
| 2622660 | Update | Security updates for the browser control Google Chromium delivered with SAP Business Client BC-FES-BUS-DSKK | HotNews | 10,0 |
| 3271091 | Update | CVE-2022-41268 Privilege escalation vulnerability in SAP Business Planning and Consolidation EPM-BPC-NW | High | 8,5 |
| 3256787 | New | CVE-2023-24530 Unrestricted Upload of File in SAP BusinessObjects Business Intelligence Platform (CMC) BI-BIP-CMC | High | 8,4 |
| 3287291 | New | CVE-2023-23854 Missing Authorization check in SAP NetWeaver AS ABAP and ABAP Platform BC-DWB-TOO-ABA | Low | 3,8 |
| 3285757 | New | CVE-2023-24523 Privilege Escalation vulnerability in SAP Host Agent (Start Service) BC-CCM-HAG | High | 8,8 |
| 2788178 | New | CVE-2023-24525 Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI CA-WUI-UI-TAG | Medium | 4,3 |
| 2985905 | New | CVE-2023-24524 Missing Authorization check in SAP S/4 HANA Map Treasury Correspondence Format Data CA-GTF-CSC-DME | Medium | 6,5 |
| 3275841 | New | CVE-2023-23851 Unrestricted File Upload in SAP Business Planning and Consolidation EPM-BPC-NW-INF | Medium | 5,4 |
| 3293786 | New | CVE-2023-23858 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform BC-ABA-LA | Medium | 6,1 |
| 3281724 | New | CVE-2023-0019 Missing Authorization check in SAP GRC (Process Control) GRC-SPC-AC | Medium | 6,5 |
| 3290901 | New | CVE-2023-24528 Missing Authorization Check in SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests) FI-TV-ODT-MTR | Medium | 6,5 |
| 3282663 | New | CVE-2023-24529 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (Business Server Pages application) CA-GTF-PCF | Medium | 6,1 |
| 3274585 | New | CVE-2023-25614 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (BSP Framework) BC-BSP | Medium | 6,1 |
| 3269118 | New | CVE-2023-24522 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (BSP Framework) BC-BSP | Medium | 6,1 |
| 3269151 | New | CVE-2023-24521 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (BSP Framework) BC-BSP | Medium | 6,1 |
| 3271227 | New | CVE-2023-23853 URL Redirection vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform BC-MID-ICF | Medium | 6,1 |
| 3268959 | New | [Multiple CVEs] Multiple vulnerabilities in SAP NetWeaver AS for ABAP and ABAP Platform BC-MID-AC | Medium | 6,1 |
| 3266751 | New | CVE-2023-23852 Cross-Site Scripting (XSS) vulnerability in SAP Solution Manager 7.2 SV-SMG-MON-SYS | Medium | 6,1 |
| 3265846 | New | CVE-2023-0024 Cross Site Scripting in SAP Solution Manager (BSP Application) SV-SMG-SVD-SWB | Medium | 6,5 |
| 3267442 | New | CVE-2023-0025 Cross Site Scripting in SAP Solution Manager (BSP Application) SV-SMG-SVD-SWB | Medium | 6,5 |
| 3270509 | New | CVE-2023-23855 URL Redirection vulnerability in SAP Solution Manager SV-SMG-OP | Medium | 6,5 |
| 3263135 | New | CVE-2023-0020 Information disclosure vulnerability in SAP BusinessObjects Business Intelligence platform BI-BIP-INV | High | 8,5 |
| 3263863 | New | CVE-2023-23856 Cross-Site Scripting (XSS) vulnerability in Web Intelligence Interface BI-RA-WBI-FE | Medium | 4,3 |
| 3262544 | Update | CVE-2022-41262 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS for Java (Http Provider Service) BC-JAS-WEB | Medium | 6,1 |
| 3268172 | Update | CVE-2022-41264 Code Injection vulnerability in SAP BASIS BC-DB-HDB-POR | High | 8,8 |
| 3283283 | Update | CVE-2023-0013 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform BC-ABA-LA | Medium | 6,1 |