{"id":2944,"date":"2023-05-19T08:00:31","date_gmt":"2023-05-19T06:00:31","guid":{"rendered":"http:\/\/192.168.20.3\/?p=2944"},"modified":"2024-12-10T09:29:01","modified_gmt":"2024-12-10T08:29:01","slug":"sap-security-patch-day-mayo-2023","status":"publish","type":"post","link":"https:\/\/orekait.com\/es\/sap-security-patch-day-mayo-2023\/","title":{"rendered":"SAP Security Patch Day<br> <span class=\"font-300\">Mayo 2023<\/span>"},"content":{"rendered":"<p>[et_pb_section fb_built=&#8221;1&#8243; admin_label=&#8221;section&#8221; _builder_version=&#8221;4.16&#8243; global_colors_info=&#8221;{}&#8221;][et_pb_row admin_label=&#8221;Imagen principal&#8221; _builder_version=&#8221;4.16&#8243; background_size=&#8221;initial&#8221; background_position=&#8221;top_left&#8221; background_repeat=&#8221;repeat&#8221; global_colors_info=&#8221;{}&#8221;][et_pb_column type=&#8221;4_4&#8243; _builder_version=&#8221;4.16&#8243; custom_padding=&#8221;|||&#8221; global_colors_info=&#8221;{}&#8221; custom_padding__hover=&#8221;|||&#8221;][et_pb_image src=&#8221;https:\/\/orekait.com\/wp-content\/uploads\/2023\/05\/Patch-Day-mayo.png&#8221; alt=&#8221;cloud-public&#8221; title_text=&#8221;Patch-Day-mayo&#8221; admin_label=&#8221;Imagen principal&#8221; module_class=&#8221;post-img&#8221; _builder_version=&#8221;4.25.2&#8243; _module_preset=&#8221;default&#8221; global_colors_info=&#8221;{}&#8221;][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row admin_label=&#8221;Cuerpo&#8221; _builder_version=&#8221;4.25.2&#8243; _module_preset=&#8221;default&#8221; global_colors_info=&#8221;{}&#8221;][et_pb_column type=&#8221;4_4&#8243; _builder_version=&#8221;4.25.2&#8243; _module_preset=&#8221;default&#8221; global_colors_info=&#8221;{}&#8221;][et_pb_text admin_label=&#8221;Texto&#8221; _builder_version=&#8221;4.25.2&#8243; header_2_font_size=&#8221;24px&#8221; header_3_font_size=&#8221;20px&#8221; background_size=&#8221;initial&#8221; background_position=&#8221;top_left&#8221; background_repeat=&#8221;repeat&#8221; global_colors_info=&#8221;{}&#8221;]<\/p>\n<p>Desde\u00a0Oreka\u00a0IT continuamos actualizando nuestro art\u00edculo mensual con las \u00faltimas notas de seguridad liberadas por SAP,\u00a0en este post analizamos las \u00faltimas notas de seguridad liberadas por SAP y las explicamos de la manera m\u00e1s sencilla posible.<\/p>\n<p>En cuanto al an\u00e1lisis cuantitativo, en esta nueva publicaci\u00f3n del\u00a0security\u00a0patch\u00a0day, SAP ha publicado 24 notas, de las cuales 11 son de importancia\u00a0high, y en esta ocasi\u00f3n 2 son sido clasificadas c\u00f3mo\u00a0hot\u00a0news.<\/p>\n<p>En esta ocasi\u00f3n queremos destacar la nota\u00a0<strong>3307833, ya que resuelve m\u00faltiples\u00a0<\/strong>vulnerabilidades, adem\u00e1s, algunas de ellas se han visto actualizadas y resueltas por esta nueva nota.<\/p>\n<p><strong>A continuaci\u00f3n, analizaremos estas 11 notas:<\/strong><\/p>\n<p><strong>3328495\u00a0\u2013\u00a0Multiple\u00a0vulnerabilities\u00a0associated\u00a0with\u00a0Reprise\u00a0License\u00a0Manager 14.2\u00a0component\u00a0used\u00a0with\u00a0SAP 3D Visual Enterprise\u00a0License\u00a0Manager<\/strong><\/p>\n<p>La nota 3328495 recopila las m\u00faltiples vulnerabilidades que afectan al producto Reprise\u00a0License\u00a0Manager 14, el cual tiene varias vulnerabilidades relacionadas con la interfaz web.<\/p>\n<p>Para resolver estas vulnerabilidades SAP indica que debemos actualizar a la versi\u00f3n 15.9.1-sap2 de SAP 3D Visual Enterprise\u00a0License\u00a0Manager, podemos acceder a esta actualizaci\u00f3n en el siguiente\u00a0<a href=\"https:\/\/developers.sap.com\/trials-downloads.html?search=visual+enterprise\" target=\"_blank\" rel=\"noreferrer noopener\">enlace<\/a><strong>.<\/strong><\/p>\n<p>Adem\u00e1s, para poder mitigar estas vulnerabilidades mientras planeamos la actualizaci\u00f3n de este software, SAP define un\u00a0workaround\u00a0que podemos seguir. Estas indicaciones se encuentran en la nota 3328495.<\/p>\n<p><strong>3307833 \u2013\u00a0Information\u00a0Disclosure\u00a0vulnerabilities\u00a0in SAP\u00a0BusinessObjects\u00a0Intelligence\u00a0Platform<\/strong><\/p>\n<p>La nota 3307833 recopila la informaci\u00f3n de la vulnerabilidad CVE-2023-28762 por la que SAP\u00a0BusinessObjects\u00a0Business\u00a0Intelligence\u00a0permite que un atacante autenticado con privilegios de administrador obtenga el token de inicio de sesi\u00f3n de cualquier usuario o servidor de BI conectado a trav\u00e9s de la red sin ninguna interacci\u00f3n del usuario. El atacante puede hacerse pasar por cualquier usuario pudiendo acceder y modificar datos. El atacante tambi\u00e9n puede hacer que el sistema no est\u00e9 disponible parcial o totalmente.<\/p>\n<p>La soluci\u00f3n a esta vulnerabilidad consiste en actualizar SBOP BI PLATFORM a las versiones indicadas en la nota 3307833, adem\u00e1s en el apartado de soluci\u00f3n hay documentaci\u00f3n adicional.<\/p>\n<p>Es importante destacar que la nota 3307833, incluye correcciones de seguridad para vulnerabilidades antiguas de SAP\u00a0BusinessObjects\u00a0Business\u00a0Intelligence, que se han visto actualizadas y requieren la implementaci\u00f3n de la nota 3307833.<\/p>\n<p><strong>3317453 \u2013\u00a0Improper\u00a0access\u00a0control\u00a0during\u00a0application\u00a0start-up\u00a0in SAP AS\u00a0NetWeaver\u00a0JAVA<\/strong><\/p>\n<p>Vulnerabilidad en NW\u00a0Application\u00a0Server Java por la que un atacante no autenticado puede conectarse a una interfaz abierta y mediante una API abierta de nombres y directorios, instanciar un objeto que tiene m\u00e9todos a los que se puede llamar sin autorizaci\u00f3n y autenticaci\u00f3n adicionales. Una llamada posterior a uno de estos m\u00e9todos puede leer o cambiar el estado de los servicios existentes sin ning\u00fan efecto sobre la disponibilidad.<\/p>\n<p>Para resolver esta vulnerabilidad, debemos actualizar a las versiones de SP indicadas en la nota 3317453.<\/p>\n<p><strong>3323415 \u2013\u00a0Privilege\u00a0escalation\u00a0vulnerability\u00a0in SAP IBP\u00a0add-in\u00a0for\u00a0Microsoft Excel<\/strong><\/p>\n<p>El instalador de SAP IBP, el complemento para Microsoft\u00a0Excel,\u00a0permite que un atacante autenticado aplique cambios en el\u00a0InstallScript\u00a0que le permitan escalar privilegios y ejecutar c\u00f3digo como administrador, pudiendo causar un alto impacto en la confidencialidad, integridad y disponibilidad del sistema.<\/p>\n<p>Los usuarios que ya tienen el complemento instalado no se ven afectados por esta vulnerabilidad, s\u00f3lo los que hagan nuevas instalaciones.<\/p>\n<p>Esta vulnerabilidad ha sido resuelta en las versiones 2211.3.0, 2302.4.0 y superiores de Excel\u00a0add-in.<\/p>\n<p><strong>3213507 \u2013\u00a0Information\u00a0Disclosure\u00a0vulnerability\u00a0in SAP\u00a0BusinessObjects\u00a0Business\u00a0Intelligence\u00a0Platform\u00a0(CMC)<\/strong><\/p>\n<p>Esta nota ha sido actualizada, ahora se encuentra incluida en la documentaci\u00f3n de la nota 3307833, que hemos tratado en este mismo art\u00edculo.<\/p>\n<p>Es importante destacar que la nota 3307833, incluye correcciones de seguridad para la vulnerabilidad CVE-2022-31596, y todos los clientes que tengan implementada la nota 3213507, deben implementarla.<\/p>\n<p><strong>3217303 \u2013\u00a0Information\u00a0Disclosure\u00a0vulnerability\u00a0in SAP\u00a0BusinessObjects\u00a0Business\u00a0Intelligence\u00a0Platform\u00a0(CMC)<\/strong><\/p>\n<p>Esta nota ha sido actualizada, ahora se encuentra incluida en la documentaci\u00f3n de la nota 3307833, que hemos tratado en este mismo art\u00edculo.<\/p>\n<p>Es importante destacar que la nota 3307833, incluye correcciones de seguridad para la vulnerabilidad CVE-2022-39014, y todos los clientes que tengan implementada la nota 3217303, deben implementarla.<\/p>\n<p><strong>3300624 \u2013\u00a0Memory\u00a0Corruption\u00a0vulnerability\u00a0in SAP\u00a0PowerDesigner\u00a0(Proxy)<\/strong><\/p>\n<p>En SAP\u00a0PowerDesigner, un atacante podr\u00eda enviar una solicitud manipulada desde un host remoto a la m\u00e1quina proxy y bloquear el servidor proxy, debido a una implementaci\u00f3n incorrecta de la gesti\u00f3n de la memoria, lo que provoca una corrupci\u00f3n de la memoria. Esto puede causar un alto impacto en la disponibilidad de la aplicaci\u00f3n.<\/p>\n<p>Podemos resolver esta vulnerabilidad con la actualizaci\u00f3n 6.7 SP06 PL03 o superior de SAP\u00a0PowerDesigner\u00a0Proxy.<\/p>\n<p><strong>3320145 \u2013\u00a0Denial\u00a0of\u00a0service\u00a0(DOS) in SAP Commerce<\/strong><\/p>\n<p>Debido al hecho de que SAP Commerce usa\u00a0XStream, se podr\u00eda evitar que los usuarios leg\u00edtimos accedan a un servicio al finalizar la aplicaci\u00f3n con un error de desbordamiento de pila. Esto tiene un impacto directo en la disponibilidad del sistema.<\/p>\n<p>Para solucionar esta vulnerabilidad podemos actualizar al SP indicado en la nota 3320145.<\/p>\n<p><strong>3320467 \u2013\u00a0Information\u00a0Disclosure\u00a0vulnerability\u00a0in SAP GUI\u00a0for\u00a0Windows<\/strong><\/p>\n<p>La nota 3320467 trata la vulnerabilidad con c\u00f3digo CVE-2023-32113, por la que SAP GUI para Windows permitir\u00eda la creaci\u00f3n de un acceso directo que, al ser usado por la v\u00edctima, obtener informaci\u00f3n de la autenticaci\u00f3n de la v\u00edctima.<\/p>\n<p>Dependiendo de las autorizaciones de la v\u00edctima, el atacante podr\u00eda leer y modificar informaci\u00f3n potencialmente confidencial.<\/p>\n<p>Esta vulnerabilidad afecta a versiones de SAPGUI 8.00 y SAPGUI 7.70, para resolverla debemos actualizar estas aplicaciones a la \u00faltima versi\u00f3n disponible.<\/p>\n<p><strong>3321309 \u2013\u00a0Information\u00a0Disclosure\u00a0vulnerability\u00a0in SAP Commerce (Backoffice)<\/strong><\/p>\n<p>Bajo ciertas condiciones, SAP Commerce\u00a0Backoffice\u00a0permite que un atacante acceda a la informaci\u00f3n a trav\u00e9s de una solicitud POST manipulada que, de otro modo, estar\u00eda restringida, lo que afectar\u00eda la confidencialidad del sistema.<\/p>\n<p>Debemos actualizar a las versiones de SAP Commerce indicadas en la nota 3321309.<\/p>\n<p><strong>3326210 \u2013\u00a0Improper\u00a0Neutralization\u00a0of\u00a0Input in SAPUI5<\/strong><\/p>\n<p>Debido a la neutralizaci\u00f3n incorrecta de la entrada en SAPUI5, se podr\u00eda realizar una inyecci\u00f3n de c\u00f3digo CSS, pudiendo bloquear la interacci\u00f3n del usuario con la aplicaci\u00f3n y permitiendo al atacante a leer o modificar la informaci\u00f3n del usuario a trav\u00e9s de un ataque de phishing.<\/p>\n<p>Debemos actualizar a las versiones de SAPUI5 indicadas en la nota 3326210.<\/p>\n<p>En la siguiente tabla vemos todas las notas liberadas este mes para comprobar si aplican o no en vuestros sistemas:<\/p>\n<figure class=\"wp-block-table is-style-stripes\">\n<table>\n<tbody>\n<tr>\n<td class=\"has-text-align-left\" data-align=\"left\"><strong>Note<\/strong><\/td>\n<td class=\"has-text-align-left\" data-align=\"left\"><strong>CVE<\/strong><\/td>\n<td class=\"has-text-align-left\" data-align=\"left\"><strong>Title<\/strong><\/td>\n<td class=\"has-text-align-center\" data-align=\"center\"><strong>Priority<\/strong><\/td>\n<td class=\"has-text-align-center\" data-align=\"center\"><strong>CVSS<\/strong><\/td>\n<\/tr>\n<tr>\n<td class=\"has-text-align-left\" data-align=\"left\">3328495<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">Multiple CVEs<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">Multiple vulnerabilities associated with Reprise License Manager 14.2 component used with SAP 3D Visual Enterprise License Manager<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">Hot News<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">9.8<\/td>\n<\/tr>\n<tr>\n<td class=\"has-text-align-left\" data-align=\"left\">3307833<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">[CVE-2023-28762]<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">Information Disclosure vulnerabilities in SAP BusinessObjects Intelligence Platform<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">Hot News<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">9.1<\/td>\n<\/tr>\n<tr>\n<td class=\"has-text-align-left\" data-align=\"left\">3317453<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">[CVE-2023-30744]<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">Improper access control during application start-up in SAP AS NetWeaver JAVA<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">High<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">8.2<\/td>\n<\/tr>\n<tr>\n<td class=\"has-text-align-left\" data-align=\"left\">3323415<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">[CVE-2023-29080]<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">Privilege escalation vulnerability in SAP IBP add-in for Microsoft Excel<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">High<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">8.2<\/td>\n<\/tr>\n<tr>\n<td class=\"has-text-align-left\" data-align=\"left\">3213507<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">[Update][CVE-2022-31596]<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (CMC)<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">High<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">8.2<\/td>\n<\/tr>\n<tr>\n<td class=\"has-text-align-left\" data-align=\"left\">3217303<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">[Update][CVE-2022-39014]<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (CMC)<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">High<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">7.7<\/td>\n<\/tr>\n<tr>\n<td class=\"has-text-align-left\" data-align=\"left\">3300624<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">[CVE-2023-32111]<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">Memory Corruption vulnerability in SAP PowerDesigner (Proxy)<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">High<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">7.5<\/td>\n<\/tr>\n<tr>\n<td class=\"has-text-align-left\" data-align=\"left\">3320145<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">[CVE-2022-41966]<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">Denial of service (DOS) in SAP Commerce Related CVE \u2013 CVE-2022-41966<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">High<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">7.5<\/td>\n<\/tr>\n<tr>\n<td class=\"has-text-align-left\" data-align=\"left\">3320467<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">[CVE-2023-32113]<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">Information Disclosure vulnerability in SAP GUI for Windows<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">High<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">7.5<\/td>\n<\/tr>\n<tr>\n<td class=\"has-text-align-left\" data-align=\"left\">3321309<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">[CVE-2023-32111]<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">Information Disclosure vulnerability in SAP Commerce (Backoffice) Related CVE \u2013 CVE-2023-32111<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">High<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">7.5<\/td>\n<\/tr>\n<tr>\n<td class=\"has-text-align-left\" data-align=\"left\">3326210<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">[CVE-2023-30743]<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">Improper Neutralization of Input in SAPUI5<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">High<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">7.1<\/td>\n<\/tr>\n<tr>\n<td class=\"has-text-align-left\" data-align=\"left\">3233226<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">[Update][CVE-2022-32244]<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Commentary DB)<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">Medium<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">6.8<\/td>\n<\/tr>\n<tr>\n<td class=\"has-text-align-left\" data-align=\"left\">3313484<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">[CVE-2023-30740]<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence platform<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">Medium<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">6.3<\/td>\n<\/tr>\n<tr>\n<td class=\"has-text-align-left\" data-align=\"left\">3309935<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">[CVE-2023-30741]<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence platform<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">Medium<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">6.1<\/td>\n<\/tr>\n<tr>\n<td class=\"has-text-align-left\" data-align=\"left\">3315971<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">[CVE-2023-30742]<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">Medium<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">6.1<\/td>\n<\/tr>\n<tr>\n<td class=\"has-text-align-left\" data-align=\"left\">3319400<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">[CVE-2023-31406]<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence platform<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">Medium<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">6.1<\/td>\n<\/tr>\n<tr>\n<td class=\"has-text-align-left\" data-align=\"left\">3213524<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">[Update][CVE-2022-32244]<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Commentary DB)<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">Medium<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">6.0<\/td>\n<\/tr>\n<tr>\n<td class=\"has-text-align-left\" data-align=\"left\">3312892<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">[CVE-2023-31407]<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">Cross-Site Scripting (XSS) vulnerability in SAP Business Planning and Consolidation<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">Medium<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">5.4<\/td>\n<\/tr>\n<tr>\n<td class=\"has-text-align-left\" data-align=\"left\">3315979<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">[CVE-2023-29188]<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">Medium<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">5.4<\/td>\n<\/tr>\n<tr>\n<td class=\"has-text-align-left\" data-align=\"left\">3145769<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">[Update][CVE-2022- 27667]<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (CMC)<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">Medium<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">5.3<\/td>\n<\/tr>\n<tr>\n<td class=\"has-text-align-left\" data-align=\"left\">3038911<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">[CVE-2023-31404]<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">Information Disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Service)<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">Medium<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">5.0<\/td>\n<\/tr>\n<tr>\n<td class=\"has-text-align-left\" data-align=\"left\">3302595<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">[CVE-2023-28764]<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence platform<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">Low<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">3.7<\/td>\n<\/tr>\n<tr>\n<td class=\"has-text-align-left\" data-align=\"left\">3117978<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">[Update][CVE-2023-29111]<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">Information Disclosure vulnerability in SAP Application Interface Framework (ODATA service)<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">Low<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">3.1<\/td>\n<\/tr>\n<tr>\n<td class=\"has-text-align-left\" data-align=\"left\">2335198<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">[CVE-2023-32112]<\/td>\n<td class=\"has-text-align-left\" data-align=\"left\">Missing Authorization Check in Vendor Master Hierarchy<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">Low<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">2.8<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n<p>&nbsp;<\/p>\n<p>Este mes SAP ha liberado 24 notas de seguridad de las cuales 2 tienen una puntuaci\u00f3n CVSS por encima de 9.<\/p>\n<figure class=\"wp-block-table is-style-stripes\">\n<table>\n<tbody>\n<tr>\n<td>\u00a0<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\"><strong>LOW<\/strong><\/td>\n<td class=\"has-text-align-center\" data-align=\"center\"><strong>MEDIUM<\/strong><\/td>\n<td class=\"has-text-align-center\" data-align=\"center\"><strong>HIGH<\/strong><\/td>\n<td class=\"has-text-align-center\" data-align=\"center\"><strong>HOT NEWS<\/strong><\/td>\n<td class=\"has-text-align-center\" data-align=\"center\"><strong>TOTAL<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Mayo<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">3<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">10<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">9<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">2<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\"><strong>24<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Abril<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">3<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">15<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">1<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">5<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\"><strong>24<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Marzo<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">0<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">10<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">4<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">5<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\"><strong>19<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Febrero<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">0<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">20<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">5<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">1<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\"><strong>26<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Enero<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">0<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">5<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">0<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\">5<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\"><strong>12<\/strong><\/td>\n<\/tr>\n<tr>\n<td>TOTAL<\/td>\n<td class=\"has-text-align-center\" data-align=\"center\"><strong>6<\/strong><\/td>\n<td class=\"has-text-align-center\" data-align=\"center\"><strong>60<\/strong><\/td>\n<td class=\"has-text-align-center\" data-align=\"center\"><strong>19<\/strong><\/td>\n<td class=\"has-text-align-center\" data-align=\"center\"><strong>18<\/strong><\/td>\n<td class=\"has-text-align-center\" data-align=\"center\"><strong>105<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n<p><strong>El desglose de vulnerabilidades encontradas en los sistemas SAP ha sido el siguiente:<\/strong><\/p>\n<figure class=\"wp-block-table is-style-stripes\">\n<table>\n<tbody>\n<tr>\n<td>\u00a0<\/td>\n<td><strong>Enero<\/strong><\/td>\n<td><strong>Febrero<\/strong><\/td>\n<td><strong>Marzo<\/strong><\/td>\n<td><strong>Abril<\/strong><\/td>\n<td><strong>Mayo<\/strong><\/td>\n<td><strong>TOTAL<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Clickjacking<\/td>\n<td>\u00a0<\/td>\n<td>\u00a0<\/td>\n<td>\u00a0<\/td>\n<td>\u00a0<\/td>\n<td>\u00a0<\/td>\n<td><strong>0<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Code\u00a0Injection<\/td>\n<td>2<\/td>\n<td>1<\/td>\n<td>2<\/td>\n<td>4<\/td>\n<td>\u00a0<\/td>\n<td><strong>9<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Cross-Site Scripting<\/td>\n<td>3<\/td>\n<td>12<\/td>\n<td>4<\/td>\n<td>1<\/td>\n<td>5<\/td>\n<td><strong>25<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Denial\u00a0of\u00a0Service<\/td>\n<td>\u00a0<\/td>\n<td>\u00a0<\/td>\n<td>2<\/td>\n<td>2<\/td>\n<td>1<\/td>\n<td><strong>5<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Improper\u00a0authentication<\/td>\n<td>4<\/td>\n<td>4<\/td>\n<td>2<\/td>\n<td>3<\/td>\n<td>1<\/td>\n<td><strong>14<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Improper\u00a0input\u00a0validation<\/td>\n<td>1<\/td>\n<td>3<\/td>\n<td>\u00a0<\/td>\n<td>1<\/td>\n<td>2<\/td>\n<td><strong>7<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Information\u00a0Disclosure<\/td>\n<td>1<\/td>\n<td>1<\/td>\n<td>3<\/td>\n<td>3<\/td>\n<td>12<\/td>\n<td><strong>20<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Memory\u00a0corruption<\/td>\n<td>\u00a0<\/td>\n<td>\u00a0<\/td>\n<td>2<\/td>\n<td>\u00a0<\/td>\n<td>1<\/td>\n<td><strong>3<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Missing\u00a0Authorization\u00a0Check<\/td>\n<td>\u00a0<\/td>\n<td>1<\/td>\n<td>4<\/td>\n<td>5<\/td>\n<td>1<\/td>\n<td><strong>11<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Missing\u00a0input\u00a0Validation<\/td>\n<td>\u00a0<\/td>\n<td>\u00a0<\/td>\n<td>\u00a0<\/td>\n<td>\u00a0<\/td>\n<td>\u00a0<\/td>\n<td><strong>0<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Missing\u00a0XML\u00a0Validation<\/td>\n<td>\u00a0<\/td>\n<td>\u00a0<\/td>\n<td>\u00a0<\/td>\n<td>\u00a0<\/td>\n<td>\u00a0<\/td>\n<td><strong>0<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Remote\u00a0Code\u00a0Execution<\/td>\n<td>2<\/td>\n<td>\u00a0<\/td>\n<td>\u00a0<\/td>\n<td>2<\/td>\n<td>\u00a0<\/td>\n<td><strong>4<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Server\u00a0Side\u00a0Request\u00a0Forgery<\/td>\n<td>\u00a0<\/td>\n<td>\u00a0<\/td>\n<td>\u00a0<\/td>\n<td>\u00a0<\/td>\n<td>\u00a0<\/td>\n<td><strong>0<\/strong><\/td>\n<\/tr>\n<tr>\n<td>SQL\u00a0Injection<\/td>\n<td>1<\/td>\n<td>\u00a0<\/td>\n<td>\u00a0<\/td>\n<td>\u00a0<\/td>\n<td>\u00a0<\/td>\n<td><strong>1<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Otros<\/td>\n<td>2<\/td>\n<td>6<\/td>\n<td>3<\/td>\n<td>6<\/td>\n<td>3<\/td>\n<td><strong>20<\/strong><\/td>\n<\/tr>\n<tr>\n<td>\u00a0<\/td>\n<td><strong>16<\/strong><\/td>\n<td><strong>28<\/strong><\/td>\n<td><strong>22<\/strong><\/td>\n<td><strong>27<\/strong><\/td>\n<td><strong>26<\/strong><\/td>\n<td><strong>119<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n<p>La diferencia de notas liberadas y vulnerabilidades es debido a que una nota puede solucionar m\u00faltiples vulnerabilidades.<\/p>\n<p>Nos despedimos recomendando pasarse por el apartado de\u00a0<strong>security\u00a0notes\u00a0<\/strong>del\u00a0Launchpad\u00a0de SAP y analizar las notas liberadas desde la \u00faltima actualizaci\u00f3n de nuestros sistemas e instalar las que apliquen a los sistemas de cada empresa.<\/p>\n<p>Art\u00edculos anteriores de este mismo a\u00f1o 2023:<\/p>\n<p><a href=\"https:\/\/orekait.com\/blog\/sap-security-patch-day-enero-2023\/\" target=\"_blank\" rel=\"noreferrer noopener\">ENERO 2023<\/a>\u00a0\u2013\u00a0<a href=\"https:\/\/orekait.com\/blog\/sap-security-patch-day-febrero-2\/\" target=\"_blank\" rel=\"noreferrer noopener\">FEBRERO 2023<\/a>\u00a0\u2013\u00a0<a href=\"https:\/\/orekait.com\/blog\/sap-security-patch-day-marzo-2023\/\" target=\"_blank\" rel=\"noreferrer noopener\">MARZO 2023<\/a>\u00a0\u2013\u00a0<a href=\"https:\/\/orekait.com\/blog\/sap-security-patch-day-abril-2023\/\" target=\"_blank\" rel=\"noreferrer noopener\">ABRIL 2023\u00a0<\/a><\/p>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row admin_label=&#8221;M\u00e1s informaci\u00f3n&#8221; _builder_version=&#8221;4.25.2&#8243; _module_preset=&#8221;default&#8221; global_colors_info=&#8221;{}&#8221;][et_pb_column type=&#8221;4_4&#8243; _builder_version=&#8221;4.25.2&#8243; _module_preset=&#8221;default&#8221; global_colors_info=&#8221;{}&#8221;][et_pb_text _builder_version=&#8221;4.25.2&#8243; _module_preset=&#8221;default&#8221; global_colors_info=&#8221;{}&#8221;]<\/p>\n<p class=\"morado\">M\u00e1s informaci\u00f3n:<\/p>\n<p>[\/et_pb_text][et_pb_button button_url=&#8221;https:\/\/orekait.com\/es\/area-administracion-sistemas&#8221; button_text=&#8221;M\u00e1s informaci\u00f3n&#8221; module_class=&#8221;entrada-btn&#8221; _builder_version=&#8221;4.25.2&#8243; _module_preset=&#8221;default&#8221; custom_button=&#8221;on&#8221; button_text_color=&#8221;#8156EA&#8221; button_bg_color=&#8221;RGBA(255,255,255,0)&#8221; button_border_color=&#8221;#8156EA&#8221; button_border_radius=&#8221;30px&#8221; button_font=&#8221;Plus Jakarta Sans|600|||||||&#8221; button_icon=&#8221;&#x24;||divi||400&#8243; button_icon_color=&#8221;#8156EA&#8221; button_on_hover=&#8221;off&#8221; hover_enabled=&#8221;0&#8243; global_colors_info=&#8221;{}&#8221; button_text_color__hover_enabled=&#8221;on|desktop&#8221; button_text_color__hover=&#8221;#8156EA&#8221; button_bg_color__hover_enabled=&#8221;on|hover&#8221; button_bg_color__hover=&#8221;#8156EA&#8221; button_bg_enable_color__hover=&#8221;on&#8221; button_icon_color__hover_enabled=&#8221;on|hover&#8221; button_icon_color__hover=&#8221;#ffffff&#8221; url_new_window=&#8221;on&#8221; sticky_enabled=&#8221;0&#8243;][\/et_pb_button][et_pb_divider show_divider=&#8221;off&#8221; _builder_version=&#8221;4.25.2&#8243; _module_preset=&#8221;default&#8221; custom_margin=&#8221;||40px||false|false&#8221; global_colors_info=&#8221;{}&#8221;][\/et_pb_divider][\/et_pb_column][\/et_pb_row][et_pb_row use_custom_gutter=&#8221;on&#8221; admin_label=&#8221;Noticias relacionadas titulo&#8221; module_id=&#8221;fondo-articulos&#8221; _builder_version=&#8221;4.25.2&#8243; _module_preset=&#8221;default&#8221; background_color=&#8221;#f7f7f7&#8243; width=&#8221;100%&#8221; global_colors_info=&#8221;{}&#8221;][et_pb_column type=&#8221;4_4&#8243; _builder_version=&#8221;4.25.2&#8243; _module_preset=&#8221;default&#8221; global_colors_info=&#8221;{}&#8221;][et_pb_divider show_divider=&#8221;off&#8221; _builder_version=&#8221;4.25.2&#8243; _module_preset=&#8221;default&#8221; background_color=&#8221;RGBA(255,255,255,0)&#8221; custom_margin=&#8221;||40px||false|false&#8221; global_colors_info=&#8221;{}&#8221;][\/et_pb_divider][et_pb_heading title=&#8221;Quizas te pueda interesar&#8221; _builder_version=&#8221;4.25.2&#8243; _module_preset=&#8221;default&#8221; title_level=&#8221;h2&#8243; title_text_align=&#8221;center&#8221; global_colors_info=&#8221;{}&#8221;][\/et_pb_heading][et_pb_divider show_divider=&#8221;off&#8221; _builder_version=&#8221;4.25.2&#8243; _module_preset=&#8221;default&#8221; custom_margin=&#8221;||30px||false|false&#8221; global_colors_info=&#8221;{}&#8221;][\/et_pb_divider][\/et_pb_column][\/et_pb_row][et_pb_row admin_label=&#8221;Noticias relacionadas&#8221; _builder_version=&#8221;4.25.2&#8243; _module_preset=&#8221;default&#8221; width=&#8221;100%&#8221; custom_margin=&#8221;-150px||||false|false&#8221; custom_margin_tablet=&#8221;0px||||false|false&#8221; custom_margin_phone=&#8221;0px||||false|false&#8221; custom_margin_last_edited=&#8221;on|desktop&#8221; global_colors_info=&#8221;{}&#8221;][et_pb_column type=&#8221;4_4&#8243; _builder_version=&#8221;4.25.2&#8243; _module_preset=&#8221;default&#8221; global_colors_info=&#8221;{}&#8221;][et_pb_blog fullwidth=&#8221;off&#8221; posts_number=&#8221;3&#8243; include_categories=&#8221;current&#8221; show_author=&#8221;off&#8221; show_date=&#8221;off&#8221; show_pagination=&#8221;off&#8221; _builder_version=&#8221;4.25.2&#8243; _module_preset=&#8221;default&#8221; global_colors_info=&#8221;{}&#8221;][\/et_pb_blog][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section fb_built=&#8221;1&#8243; _builder_version=&#8221;4.25.2&#8243; _module_preset=&#8221;default&#8221; global_colors_info=&#8221;{}&#8221;][et_pb_row _builder_version=&#8221;4.25.2&#8243; _module_preset=&#8221;default&#8221; global_colors_info=&#8221;{}&#8221;][et_pb_column type=&#8221;4_4&#8243; _builder_version=&#8221;4.25.2&#8243; _module_preset=&#8221;default&#8221; global_colors_info=&#8221;{}&#8221;][et_pb_image src=&#8221;https:\/\/orekait.com\/wp-content\/uploads\/2023\/06\/desviaciones-de-produccion-400&#215;402-1.png&#8221; _builder_version=&#8221;4.25.2&#8243; _module_preset=&#8221;default&#8221; global_colors_info=&#8221;{}&#8221;][\/et_pb_image][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section fb_built=&#8221;1&#8243; _builder_version=&#8221;4.25.2&#8243; _module_preset=&#8221;default&#8221; global_colors_info=&#8221;{}&#8221;][et_pb_row _builder_version=&#8221;4.25.2&#8243; _module_preset=&#8221;default&#8221; global_colors_info=&#8221;{}&#8221;][et_pb_column type=&#8221;4_4&#8243; _builder_version=&#8221;4.25.2&#8243; _module_preset=&#8221;default&#8221; global_colors_info=&#8221;{}&#8221;][et_pb_image src=&#8221;https:\/\/orekait.com\/wp-content\/uploads\/2023\/05\/sistemas-hosting.png&#8221; title_text=&#8221;sistemas-hosting&#8221; _builder_version=&#8221;4.25.2&#8243; _module_preset=&#8221;default&#8221; global_colors_info=&#8221;{}&#8221;][\/et_pb_image][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Desde\u00a0Oreka\u00a0IT continuamos actualizando nuestro art\u00edculo mensual con las \u00faltimas notas de seguridad liberadas por SAP,\u00a0en este post analizamos las \u00faltimas notas de seguridad liberadas por SAP y las explicamos de la manera m\u00e1s sencilla posible. En cuanto al an\u00e1lisis cuantitativo, en esta nueva publicaci\u00f3n del\u00a0security\u00a0patch\u00a0day, SAP ha publicado 24 notas, de las cuales 11 son [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":2946,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"Lorem ipsum dolor sit amet consectetur adipiscing elit congue montes, imperdiet taciti erat elementum fermentum sem ante ultrices ridiculus, sagittis sociis egestas quisque ac semper quis odio. Aenean hendrerit ac metus dis nascetur aliquet mollis integer, rutrum vel laoreet posuere proin sagittis luctus est, tempus duis nisl ultrices parturient tempor praesent. Dignissim curabitur nascetur pellentesque augue fringilla pulvinar eros, tempus fames vehicula maecenas cubilia id, rutrum euismod integer ut scelerisque mus.\r\n\r\nVivamus auctor odio aenean rhoncus natoque dictum purus, volutpat pellentesque laoreet ridiculus consequat nisi varius euismod, augue platea convallis curae magnis taciti. Imperdiet nibh curabitur quisque orci consequat aenean pellentesque, cubilia duis senectus felis sed posuere tortor, magnis enim diam a odio sociis. Enim tellus nisl nec molestie augue luctus tempor habitant, nunc dictumst phasellus volutpat sem facilisis taciti, habitasse laoreet at turpis vel fermentum vulputate.","_et_gb_content_width":"","footnotes":""},"categories":[48,50],"tags":[],"class_list":["post-2944","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administracion-de-sistemas","category-sap-security-patch-day"],"_links":{"self":[{"href":"https:\/\/orekait.com\/es\/wp-json\/wp\/v2\/posts\/2944","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/orekait.com\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/orekait.com\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/orekait.com\/es\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/orekait.com\/es\/wp-json\/wp\/v2\/comments?post=2944"}],"version-history":[{"count":6,"href":"https:\/\/orekait.com\/es\/wp-json\/wp\/v2\/posts\/2944\/revisions"}],"predecessor-version":[{"id":20832,"href":"https:\/\/orekait.com\/es\/wp-json\/wp\/v2\/posts\/2944\/revisions\/20832"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/orekait.com\/es\/wp-json\/wp\/v2\/media\/2946"}],"wp:attachment":[{"href":"https:\/\/orekait.com\/es\/wp-json\/wp\/v2\/media?parent=2944"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/orekait.com\/es\/wp-json\/wp\/v2\/categories?post=2944"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/orekait.com\/es\/wp-json\/wp\/v2\/tags?post=2944"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}