SAP issues October 2023 advisories for their products

SAP unveiled seven security notes and updated two existing ones as a segment of its October 2023 Security Patch Day. The balance of the security notes, seven in total, are of medium severity, so not terrible.

The most urgent of these security notes pertains to the Chromium browser integrated into SAP's Business Client. This update encapsulates 37 separate fixes, inclusive of two deemed critical and twenty considered of high-severity.

As part of the fixes, SAP has addressed the libwep vulnerability CVE-2023-4863. This flaw lies in the image rendering software and has already seen active exploitation.

This particular also serves to rectify CVE-2023-5217, a distinct vulnerability in video librarly libvpx that had previously been flagged and fixed by Google in September

Furthermore, SAP's second refreshed security note this week is concentrated on a log injection vulnerability within NetWeaver. Identified as CVE-2023-31405 and holding a CVSS score of 5.3, this issue was originally patched in July 2023. However, Onapsis specifies that this updated security note doesn't supplant the original patch in its entirety. To ensure complete protection, clients should enact both the original and the update. The revised patch particularly pertains to the ENGINEAPI component, as its original remedy was found lacking.

The balance of the security notes, seven in total, are of medium severity. These notes attend to various issues like cross-site scripting (XSS), server-side request forgery (SSRF), and missing authorization checks, among others. They affect an array of SAP products, including but not limited to BusinessObjects, PowerDesigner Client, and S/4HANA.