Patch Tuesday, May 2023
Microsoft's monthly security release, Tuesday, May 9, 2023. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
2 CVEs · 0 critical · 2 exploited · 2 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
2 CVEs · 0 critical · 2 exploited · 2 with public exploit code
- 7.8HighMay 9, 2023Microsoft Win32k Memory corruptionCVE-2023-29336Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation up to SYSTEM privileges.Exploited41% likelyExploit codeExploit-DB
- 7.2HighMay 9, 2023Microsoft SharePoint Server Code / command injectionCVE-2023-24955Microsoft SharePoint Server is affected. An attacker gains arbitrary code execution and potentially elevated privileges. Patch SharePoint Server to the latest version and apply additional security measures.Exploited85% likelyExploit codeMetasploitDetection
Adobe
No tracked Adobe CVEs in this window.
SAP
2 CVEs · 0 critical · 0 exploited · 0 with public exploit code
- 6.1MediumMay 9, 2023Sap businessobjects business intelligence XSSCVE-2023-30741Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect users to untrusted site using a malicious link. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.
- 6.1MediumMay 9, 2023Sap customer relationship management s4fnd XSSCVE-2023-30742SAP CRM (WebClient UI) - versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 700, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in a stored Cross-Site Scripting (XSS) vulnerability.An attacker could store a malicious URL and lure the victim to click, causing the script supplied by the attacker to execute in the victim user's session. The information from the
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.