SAP Security Notes – June 2023

On the 13th of June 2023, SAP Security Patch Day saw the release of 8 new Security Notes.

There were 5 updates to previously released Security Notes.

Notes by severity

Highlights

On June Patch Day SAP presented 4 high-severity Notes; all of them are rated as a correction with high priority.

The list for today is not large, so this will help us to describe what you should look at as a first priority in a more detailed way.

First, we will pay attention to the Note 3102769, which is Cross-Site Scripting (XSS) vulnerability in SAP Knowledge Warehouse – with a CVSS Score of 8.8. Unauthorized attackers can launch XSS attacks using just one SAP KW component within a Web browser, potentially disclosing sensitive data. This Note was re-released with updated  “Support Packages & Patches” information for releases 7.31 and 7.40 since the last update on 23rd August 2022.

SAP UI5 gets a couple of high-prioritized corrections:

The Note 3324285 – Stored Cross-Site Scripting vulnerability in SAP UI5 (Variant Management) – with a CVSS Score of 8.2. Insufficient user-controlled input encoding in UI5 Variant Management causes a vulnerability known as Stored Cross-Site Scripting (Stored XSS). After successful exploitation, a hacker with user-level access can severely compromise user privacy, change sensitive data, and render the application unavailable to users.
Note 3326210 – Improper Neutralization of Input in SAPUI5 – with a CVSS Score of 7.1. Untrusted CSS can be injected because SAPUI5’s sap.m.FormattedText control lacks to effectively neutralize input. It prevents users from accessing the application. Additionally, the vulnerability could allow an attacker to view or modify user information through phishing attacks in the same lack of URL validation by the program. The Note was re-released from the previous Patch Day with updated ‘Solution’ and ‘Workaround’ information.

Integration with SAP Plant Connectivity for SAP Digital Manufacturing also gets an important security patch:

The last Note to mention: 3301942 – Missing Authentication in SAP Plant Connectivity and Production Connector for SAP Digital Manufacturing – with a CVSS Score of 7.9. The JSON Web Token (JWT) signature in the HTTP request provided by SAP Digital Manufacturing is not verified by SAP Plant Connectivity 15.5 (PCo) or the Production Connector for SAP Digital Manufacturing. Unauthorized callers from the internal network might therefore be able to issue service requests to PCo or the Production Connector, which might compromise the integrity of the integration with SAP Digital Manufacturing.

Summary