WARNING: SAP releases security patches for 5 critical vulnerabilities, PATCH ASAP
CVE-2023-25616 CVSS: 9.9
CVE-2023-23857 CVSS: 9.8
CVE-2023-27269 CVSS: 9.6
CVE-2023-27500 CVSS: 9.6
CVE-2023-25617 CVSS: 9.0
SAP fixed multiple critical flaws affecting SAP Business Objects Business Intelligence Platform and SAP NetWeaver.
Security flaws in SAP products are very interesting targets for threat attackers because they are used in organisations worldwide and can serve as an initial entry point to systems.
SAP Business Objects Business Intelligence Platform, versions 420, 430, is subject to a code injection vulnerability which allows an attacker to gain access to resources that are normally allowed only when a user has extra privileges. The impact on Confidentiality, Integrity, and Availability of the system is high.
SAP NetWeaver AS for Java, version 7.50, allows an unauthenticated attacker to use an open naming and directory API to access services which can be used to perform unauthorized operations that impact users and services across systems.
Upon successful exploitation of this vulnerability, the attacker can read and modify sensitive information. Additionally, this flaw can be used to lock up any element or operation of the system making it unavailable, creating a denial-of-service situation where Availability is highly impacted.
SAP NetWeaver Application Server for ABAP and ABAP Platform, versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker that does not have administrative rights to exploit a directory traversal flaw to overwrite the system files. No data can be read but critical OS files can be overwritten which has a high impact on Integrity and Availability.
An attacker with no administrative rights can exploit a directory traversal flaw in SAPRSBRO to overwrite system files. No data can be read but critical OS files can be overwritten which has a high impact on Integrity and Availability.
SAP Business Object (Adaptive Job Server), versions 420, 430, allows an attacker to execute commands remotely when program objects execution is enabled to authenticated users with scheduling rights, using the BI Launchpad, Central Management Console or a custom application based on the public java SDK. This flaw has a high impact on Confidentiality, Integrity, and Availability.
The Centre for Cyber Security Belgium strongly recommends system administrators to visit SAP’s Support Portal in order to apply the necessary patches.