SAP Security Patch Day – May 2023

SAP has released 20 security updates in the May 2023 Security Patch Day, out of which six (6) are Security Notes for SAP Business Objects.

We highly recommend all customers of this product line to review and apply all relevant security patches. The highest CVSS score of 9.1 is assigned to Patch 3307833, which addresses [CVE-2023-28762] Information Disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Console).

A HotNews patch (3328495) has been released for multiple vulnerabilities associated with the Reprise License Manager 14.2 component, used with the SAP 3D Visual Enterprise License Manager. The Reprise License Manager is a third-party software component that provides license management services for various applications, including the SAP 3D Visual Enterprise product. It allows software vendors to manage their licensing models and provides end-users with a way to activate, manage, and track their licenses. The Reprise License Manager has been found to have vulnerabilities in the past, which can be exploited by attackers to gain unauthorized access to systems or steal sensitive information. Therefore, it’s important to apply the latest security patches for this component to ensure the security of your systems.

In addition, there are seven (7) Security Patches with Priority High and various others classified as Medium. We strongly suggest reviewing all security patches, even those with a lower priority, as a successful attack typically consists of the exploitation of a chain of existing vulnerabilities.