{"id":9134,"date":"2023-06-14T17:45:03","date_gmt":"2023-06-14T15:45:03","guid":{"rendered":"https:\/\/www.inprosec.com\/?p=9134"},"modified":"2023-12-28T11:45:28","modified_gmt":"2023-12-28T09:45:28","slug":"sap-security-notes-june-2023","status":"publish","type":"post","link":"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2023\/","title":{"rendered":"SAP Security Notes, June 2023"},"content":{"rendered":"

Inprosec through its services, such as the SAP Security Assessment, helps its customers to improve the security levels of their SAP systems.<\/strong><\/p>\n\n

June 2023 notes<\/h2>\n

Summary and highlights of the month<\/h3>\n

The total number of notes\/patches was 13, 12 less than last month. The number of Hot News decreased from 3 to 0 this month. On the other hand, it is worth noting that the number of high criticality notes decreases from 9 to 4. As usual we will leave the medium and low notes unchecked this month, but we will give details of a total of 4 notes<\/strong> (all those with a CVSS of 7 or higher).<\/p>\n

We have a total of 13 scores<\/strong> for the whole month (the 13 from patch Tuesday, 8 new and 5 updates, that’s 11 scores less than last patch Tuesday).<\/p>\n

We will review in detail 4 of the total 4 high scores, 2 of the 4 are new (those of CVSS greater than or equal to 7<\/span>).<\/p>\n

    \n
  1. The most critical note of the month (with CVSS 8.8<\/span>)<\/strong> is an update of a note published in December 2021 related to “Cross-Site Scripting (XSS) vulnerability in SAP Knowledge Warehouse<\/strong>“.<\/li>\n
  2. The next criticality release (with CVSS 8.2<\/span><\/strong>) is related to “Stored Cross-Site Scripting (Stored XSS) vulnerability in UI5 Variant Management<\/strong>“.<\/li>\n
  3. The next criticality score (with CVSS 7.9<\/span><\/strong>), “Missing Authentication in SAP Plant Connectivity and Production Connector for SAP Digital Manufacturing<\/strong>“.<\/li>\n
  4. The next note in criticality (with CVSS 7.1<\/span><\/strong>), this is an update of a note published last May, related to “Improper Neutralization of Input in SAPUI5<\/strong>“<\/li>\n
  5. This month the most predominant type is “Cross-Site Scripting (XSS)<\/strong>” (7\/13 on patch day).<\/li>\n<\/ol>\n

    In the graph (post May 2023 by SAP) we can see the ranking of the June notes<\/strong><\/span> in addition to the evolution and ranking of the last 5 previous months (only the notes of Sec. Tuesday \/ Patch Day – by SAP):<\/p>\n

    \"\"<\/p>\n

    Full details<\/h3>\n

    The complete detail of the most relevant notes<\/strong> is as follows:<\/p>\n

      \n
    1. Update – Cross-Site Scripting (XSS) vulnerability in SAP Knowledge Warehouse (3102769):<\/u><\/strong> A security vulnerability has been discovered in the SAP Knowledge Warehouse (SAP KW). The usage of one SAP KW component within a Web browser enables unauthorized attackers to conduct XSS attacks, which might lead to disclose sensitive data. This note has been republished with updated “Compatibility Packs and Patches” information for versions 7.31 and 7.40. CVSS v3 Base Score: <\/strong>8,8<\/strong><\/span> \/ 10 [CVE-2021-42063].<\/strong><\/li>\n
    2. Stored Cross-Site Scripting (Stored XSS) vulnerability in UI5 Variant Management (3324285<\/u><\/strong>):<\/strong> UI5 Variant Management does not sufficiently encode user-controlled inputs on reading data from the server, resulting in Stored Cross-Site Scripting (Stored XSS) vulnerability. After successful exploitation, an attacker with user level access can cause high impact on confidentiality, modify some information and also can cause unavailability of the application at user level. This note requires manual activities for implementation. CVSS v3 Base Score: <\/strong>8,2<\/strong><\/span> \/ 10 [CVE-2023-33991].<\/strong><\/li>\n
    3. Missing Authentication in SAP Plant Connectivity and Production Connector for SAP Digital Manufacturing (3301942):<\/u><\/strong> SAP Plant Connectivity 15.5 (PCo) or the Production Connector for SAP Digital Manufacturing do not validate the signature of the JSON Web Token (JWT) in the HTTP request sent from SAP Digital Manufacturing. As a consequence, unauthorized callers from the internal network could send service requests to PCo or the Production Connector, which could have an impact on the integrity of the integration with SAP Digital Manufacturing. CVSS v3 Base Score: <\/strong>7,9<\/strong> <\/span>\/ 10<\/strong> [CVE-2023-2827]<\/strong>.<\/strong><\/li>\n
    4. Update – Improper Neutralization of Input in SAPUI5 (3326210): <\/u><\/strong>Due to improper neutralization of input in SAPUI5, sap.m.FormattedText SAPUI5 control allows injection of untrusted CSS. This blocks user\u2019s interaction with the application. Further, in the absence of URL validation by the application, the vulnerability could lead to the attacker reading or modifying user\u2019s information through phishing attack. This note has been re-released with updated ‘Solution’ and ‘Workaround’ information. Base Score: <\/strong>7,1 <\/strong><\/span>\/ 10 \u00a0[CVE-2023-30743].<\/strong><\/li>\n<\/ol>\n

      Reference links<\/strong><\/h3>\n

      Other references, from SAP and Onapsis (June):<\/p>\n

      Digital Library (sap.com)<\/a><\/p>\n

      SAP Security Patch Day June 2023 (onapsis.com)<\/a><\/p>\n

      Resources affected<\/u><\/strong><\/h3>\n
      \n
        \n
      • SAP Knowledge Warehouse, Versions -7.30, 7.31, 7.40, 7.50<\/li>\n
      • SAP Plant Connectivity, Version \u201315.5<\/li>\n
      • SAPUI5, Versions \u2013SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200<\/li>\n<\/ul>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

        Inprosec through its services, such as the SAP Security Assessment, helps its customers to improve the security levels of their SAP systems. June 2023 notes Summary and highlights of the month The total number of notes\/patches was 13, 12 less than last month. The number of Hot News decreased from 3 to 0 this month….<\/p>\n","protected":false},"author":6,"featured_media":9136,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[95,61],"tags":[],"class_list":["post-9134","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sap-notes","category-sap-security-en-2"],"acf":[],"yoast_head":"\nSAP Security Notes, June 2023 - Inprosec<\/title>\n<meta name=\"description\" content=\"All updates to SAP systems notes from June 2023, to stay current and improve the security levels of your SAP systems.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2023\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"SAP Security Notes, June 2023\" \/>\n<meta property=\"og:description\" content=\"All updates to SAP systems notes from June 2023, to stay current and improve the security levels of your SAP systems.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2023\/\" \/>\n<meta property=\"og:site_name\" content=\"Inprosec\" \/>\n<meta property=\"article:published_time\" content=\"2023-06-14T15:45:03+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-12-28T09:45:28+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/06\/notas-sap-junio-2023.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"627\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Fernando Mosquera\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fernando Mosquera\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-june-2023\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-june-2023\\\/\"},\"author\":{\"name\":\"Fernando Mosquera\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#\\\/schema\\\/person\\\/b05a40c0c3e81b819075dd95a10532e2\"},\"headline\":\"SAP Security Notes, June 2023\",\"datePublished\":\"2023-06-14T15:45:03+00:00\",\"dateModified\":\"2023-12-28T09:45:28+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-june-2023\\\/\"},\"wordCount\":657,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-june-2023\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2023\\\/06\\\/notas-sap-junio-2023.jpg\",\"articleSection\":[\"SAP Notes\",\"SAP Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-june-2023\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-june-2023\\\/\",\"url\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-june-2023\\\/\",\"name\":\"SAP Security Notes, June 2023 - Inprosec\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-june-2023\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-june-2023\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2023\\\/06\\\/notas-sap-junio-2023.jpg\",\"datePublished\":\"2023-06-14T15:45:03+00:00\",\"dateModified\":\"2023-12-28T09:45:28+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#\\\/schema\\\/person\\\/b05a40c0c3e81b819075dd95a10532e2\"},\"description\":\"All updates to SAP systems notes from June 2023, to stay current and improve the security levels of your SAP systems.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-june-2023\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-june-2023\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-june-2023\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2023\\\/06\\\/notas-sap-junio-2023.jpg\",\"contentUrl\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2023\\\/06\\\/notas-sap-junio-2023.jpg\",\"width\":1200,\"height\":627},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-june-2023\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SAP Security Notes, June 2023\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/\",\"name\":\"Inprosec\",\"description\":\"Information security is our priority.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#\\\/schema\\\/person\\\/b05a40c0c3e81b819075dd95a10532e2\",\"name\":\"Fernando Mosquera\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g\",\"caption\":\"Fernando Mosquera\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"SAP Security Notes, June 2023 - Inprosec","description":"All updates to SAP systems notes from June 2023, to stay current and improve the security levels of your SAP systems.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2023\/","og_locale":"en_US","og_type":"article","og_title":"SAP Security Notes, June 2023","og_description":"All updates to SAP systems notes from June 2023, to stay current and improve the security levels of your SAP systems.","og_url":"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2023\/","og_site_name":"Inprosec","article_published_time":"2023-06-14T15:45:03+00:00","article_modified_time":"2023-12-28T09:45:28+00:00","og_image":[{"width":1200,"height":627,"url":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/06\/notas-sap-junio-2023.jpg","type":"image\/jpeg"}],"author":"Fernando Mosquera","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Fernando Mosquera","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2023\/#article","isPartOf":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2023\/"},"author":{"name":"Fernando Mosquera","@id":"https:\/\/www.inprosec.com\/en\/#\/schema\/person\/b05a40c0c3e81b819075dd95a10532e2"},"headline":"SAP Security Notes, June 2023","datePublished":"2023-06-14T15:45:03+00:00","dateModified":"2023-12-28T09:45:28+00:00","mainEntityOfPage":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2023\/"},"wordCount":657,"commentCount":0,"image":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2023\/#primaryimage"},"thumbnailUrl":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/06\/notas-sap-junio-2023.jpg","articleSection":["SAP Notes","SAP Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2023\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2023\/","url":"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2023\/","name":"SAP Security Notes, June 2023 - Inprosec","isPartOf":{"@id":"https:\/\/www.inprosec.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2023\/#primaryimage"},"image":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2023\/#primaryimage"},"thumbnailUrl":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/06\/notas-sap-junio-2023.jpg","datePublished":"2023-06-14T15:45:03+00:00","dateModified":"2023-12-28T09:45:28+00:00","author":{"@id":"https:\/\/www.inprosec.com\/en\/#\/schema\/person\/b05a40c0c3e81b819075dd95a10532e2"},"description":"All updates to SAP systems notes from June 2023, to stay current and improve the security levels of your SAP systems.","breadcrumb":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2023\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2023\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2023\/#primaryimage","url":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/06\/notas-sap-junio-2023.jpg","contentUrl":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2023\/06\/notas-sap-junio-2023.jpg","width":1200,"height":627},{"@type":"BreadcrumbList","@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-june-2023\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.inprosec.com\/en\/"},{"@type":"ListItem","position":2,"name":"SAP Security Notes, June 2023"}]},{"@type":"WebSite","@id":"https:\/\/www.inprosec.com\/en\/#website","url":"https:\/\/www.inprosec.com\/en\/","name":"Inprosec","description":"Information security is our priority.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.inprosec.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.inprosec.com\/en\/#\/schema\/person\/b05a40c0c3e81b819075dd95a10532e2","name":"Fernando Mosquera","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g","caption":"Fernando Mosquera"}}]}},"_links":{"self":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts\/9134","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/comments?post=9134"}],"version-history":[{"count":1,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts\/9134\/revisions"}],"predecessor-version":[{"id":9138,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts\/9134\/revisions\/9138"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/media\/9136"}],"wp:attachment":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/media?parent=9134"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/categories?post=9134"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/tags?post=9134"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}