CERTFR-2023-AVI-1020
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et un déni de service à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
SAP N/A SAP EMARSYS SDK ANDROID version 3.6.2
SAP N/A Librairie cloud-security-services-integration-library versions antérieures à 2.17.0
SAP N/A SAP HCM (SMART PAYE solution) versions S4HCMCIE 100, SAP_HRCIE 600, SAP_HRCIE 604 et SAP_HRCIE 608
SAP N/A SAP Master Data Governance versions 731, 732, 746, 747, 748, 749, 800, 751,752,801,802, 803, 804, 805, 806, 807 et 808
SAP N/A Business Objects BI Platform versions 420 et 430
SAP N/A SAP BusinessObjects Web Intelligence version 420
SAP N/A SAP Biller Direct versions 635 et 750
SAP N/A SAPUI5 versions SAP_UI 750, SAP_UI 753, SAP_UI 754, SAP_UI 755, SAP_UI 756 et UI_700 200
SAP N/A SAP Cloud Connector version 2.0
SAP N/A Librairie sap-xssec versions antérieures à 4.1.0
SAP N/A Librairie github.com/sap/cloud-security-client-go versions antérieures à 0.17.0
SAP Commerce Cloud SAP Commerce Cloud version 8.1
SAP N/A SAP Solution Manager version 720
SAP N/A Librairie @sap/xssec versions antérieures à 3.6.0
SAP N/A SAP ECC et SAP S/4HANA (IS-OIL) versions 600, 602, 603, 604, 605, 606, 617, 618, 800, 802, 803, 804, 805, 806 et 807
SAP N/A SAP GUI pour Windows et SAP GUI pour Java versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758
SAP NetWeaver Application Server ABAP et ABAP Platform SAP NetWeaver Application Server ABAP et ABAP Platform versions SAP_BASIS 700, SAP_BASIS731, SAP_BASIS740 et SAP_BASIS750
SAP N/A SAP_BS_FND version 702
SAP N/A Librairie cloud-security-services-integration-library versions 3.3.x antérieures à 3.3.0
SAP N/A SAP Business Client versions 6.5, 7.0 et 7.7
SAP N/A SAP Fiori Launchpad versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, UI_700 200 et SAP_BASIS 793
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SAP EMARSYS SDK ANDROID version 3.6.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Librairie cloud-security-services-integration-library versions ant\u00e9rieures \u00e0 2.17.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP HCM (SMART PAYE solution) versions S4HCMCIE 100, SAP_HRCIE 600, SAP_HRCIE 604 et SAP_HRCIE 608",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Master Data Governance versions 731, 732, 746, 747, 748, 749, 800, 751,752,801,802, 803, 804, 805, 806, 807 et 808",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Business Objects BI Platform versions 420 et 430",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP BusinessObjects Web Intelligence version 420",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Biller Direct versions 635 et 750",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAPUI5 versions SAP_UI 750, SAP_UI 753, SAP_UI 754, SAP_UI 755, SAP_UI 756 et UI_700 200",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Cloud Connector version 2.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Librairie sap-xssec versions ant\u00e9rieures \u00e0 4.1.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Librairie github.com/sap/cloud-security-client-go versions ant\u00e9rieures \u00e0 0.17.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Commerce Cloud version 8.1",
      "product": {
        "name": "Commerce Cloud",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Solution Manager version 720",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Librairie @sap/xssec versions ant\u00e9rieures \u00e0 3.6.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP ECC et SAP S/4HANA (IS-OIL) versions 600, 602, 603, 604, 605, 606, 617, 618, 800, 802, 803, 804, 805, 806 et 807",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP GUI pour Windows et SAP GUI pour Java versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP NetWeaver Application Server ABAP et ABAP Platform versions SAP_BASIS 700, SAP_BASIS731, SAP_BASIS740 et SAP_BASIS750",
      "product": {
        "name": "NetWeaver Application Server ABAP et ABAP Platform",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP_BS_FND version 702",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "Librairie cloud-security-services-integration-library versions 3.3.x ant\u00e9rieures \u00e0 3.3.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Business Client versions 6.5, 7.0 et 7.7",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Fiori Launchpad versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, UI_700 200 et SAP_BASIS 793",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-49587",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-49587"
    },
    {
      "name": "CVE-2023-42481",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-42481"
    },
    {
      "name": "CVE-2023-49584",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-49584"
    },
    {
      "name": "CVE-2023-49581",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-49581"
    },
    {
      "name": "CVE-2023-36922",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-36922"
    },
    {
      "name": "CVE-2023-42476",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-42476"
    },
    {
      "name": "CVE-2023-49580",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-49580"
    },
    {
      "name": "CVE-2023-6542",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6542"
    },
    {
      "name": "CVE-2023-42479",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-42479"
    },
    {
      "name": "CVE-2023-42478",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-42478"
    },
    {
      "name": "CVE-2021-23413",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-23413"
    },
    {
      "name": "CVE-2023-50423",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-50423"
    },
    {
      "name": "CVE-2023-49583",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-49583"
    },
    {
      "name": "CVE-2023-49577",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-49577"
    },
    {
      "name": "CVE-2023-49578",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-49578"
    },
    {
      "name": "CVE-2023-50422",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-50422"
    },
    {
      "name": "CVE-2023-49058",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-49058"
    },
    {
      "name": "CVE-2023-50424",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-50424"
    }
  ],
  "initial_release_date": "2023-12-13T00:00:00",
  "last_revision_date": "2023-12-13T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-1020",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-12-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une ex\u00e9cution de code\narbitraire \u00e0 distance et un d\u00e9ni de service \u00e0 distance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SAP ucQrx6G du 12 d\u00e9cembre 2023",
      "url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=1"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.