SAP© Security Advisories - 07 2020 - SecurityBridge Cloud Platform

We've created the first of its kind, SecurityBridge Cloud Platform, designed to prioritize SAP patches, updates, and remediation strategies that help prevent disruptions to critical business systems. Our security advisories provide SAP users with valuable insights into the security and business implications of operating SAP.

The user interface is designed to be as intuitive as possible, but we’d love to hear your feedback and suggestions.
We hope you enjoy using it!

× Yikes, there is work to do!
This time we found critical correction advisiories. We count 16 and the highest CVSS score is 10.0.

Severity

SAP© Security advisories 16

System Types

Affected SAP© system types

_{Related note}
2938831

_CVSS
6.0

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/06/23

Description
SESS: Duplicate AU3 entries in the Security Audit Log

Security Advisory

_{Related note}
2541823

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/06/09

Description
Switchable authorization checks for RFC in SAP CRM (external billing)

Security Advisory

_{Related note}
2849967

_CVSS
6.1

_{Affected system
type}
BI/BO platform

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
[CVE-2020-6276] Cross-Site Scripting (XSS) vulnerability in SAP Business Objects Business Intelligence Platform(Bipodata)

Security Advisory

_{Related note}
2874738

_CVSS
3.8

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
Missing Authorization Check in S4 ACR Brazil Option

Security Advisory

_{Related note}
2912708

_CVSS
5.4

_{Affected system
type}
BI/BO platform

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
[CVE-2020-6278] Cross-Site Scripting (XSS) vulnerability in SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC)

Security Advisory

_{Related note}
2917743

_CVSS
6.1

_{Affected system
type}
BI/BO platform

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
[CVE-2020-6281] Cross-Site Scripting (XSS) vulnerability in SAP Business Objects Business Intelligence Platform(BI Launch pad)

Security Advisory

_{Related note}
2091403

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2015/08/11

Description
Directory traversal in BC-MID-ICF

Security Advisory

_{Related note}
2603398

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
Missing authorization check in Allocation Management

Security Advisory

_{Related note}
2758000

_CVSS
6.3

_{Affected system
type}
SAP Disclosure Management

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
[CVE-2020-6267] Multiple vulnerabilities in SAP Disclosure Management

Security Advisory

_{Related note}
2537961

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
Switchable Authorization checks for RFC in MM-PUR-GF

Security Advisory

_{Related note}
2847817

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
Missing Authorization check in Travel Management

Security Advisory

_{Related note}
2927373

_CVSS
2.7

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
[CVE-2020-6280] Information Disclosure in SAP NetWeaver (ABAP Server) and ABAP Platform

Security Advisory

_{Related note}
2934135

_CVSS
10.0

_{Affected system
type}
Java

Exploit available

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
[CVE-2020-6287] Multiple Vulnerabilities in SAP NetWeaver AS JAVA (LM Configuration Wizard)

Security Advisory

_{Related note}
2896025

_CVSS
5.8

_{Affected system
type}
Java

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
[CVE-2020-6282] Server-Side Request Forgery in SAP NetWeaver AS JAVA (IIOP service)

Security Advisory

_{Related note}
2486446

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
Missing Authorization check in Pricat Inbound and Pricat Outbound

Security Advisory

_{Related note}
2932473

_CVSS
7.7

_{Affected system
type}
Java

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
[CVE-2020-6285] Information Disclosure in SAP NetWeaver (XMLToolkit for Java)

Security Advisory

Notifications

Severity

SAP© Security advisories 16

System Types

Affected SAP© system types

Related note 2938831

CVSS 6.0

Affected system type ABAP

Patchday2020-07

Released on2020/06/23

Related note 2541823

CVSS 6.3

Affected system type ABAP

Patchday2020-07

Released on2020/06/09

Related note 2849967

CVSS 6.1

Affected system type BI/BO platform

Patchday2020-07

Released on2020/07/14

Related note 2874738

CVSS 3.8

Affected system type ABAP

Patchday2020-07

Released on2020/07/14

Related note 2912708

CVSS 5.4

Affected system type BI/BO platform

Patchday2020-07

Released on2020/07/14

Related note 2917743

CVSS 6.1

Affected system type BI/BO platform

Patchday2020-07

Released on2020/07/14

Related note 2091403

CVSS 6.3

Affected system type ABAP

Patchday2020-07

Released on2015/08/11

Related note 2603398

CVSS 6.3

Affected system type ABAP

Patchday2020-07

Released on2020/07/14

Related note 2758000

CVSS 6.3

Affected system type SAP Disclosure Management

Patchday2020-07

Released on2020/07/14

Related note 2537961

CVSS 6.3

Affected system type ABAP

Patchday2020-07

Released on2020/07/14

Related note 2847817

CVSS 4.3

Affected system type ABAP

Patchday2020-07

Released on2020/07/14

Related note 2927373

CVSS 2.7

Affected system type ABAP

Patchday2020-07

Released on2020/07/14

Related note 2934135

CVSS 10.0

Affected system type Java

Exploit available

Patchday2020-07

Released on2020/07/14

Related note 2896025

CVSS 5.8

Affected system type Java

Patchday2020-07

Released on2020/07/14

Related note 2486446

CVSS 6.3

Affected system type ABAP

Patchday2020-07

_{Related note}
2938831

_CVSS
6.0

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/06/23

_{Related note}
2541823

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/06/09

_{Related note}
2849967

_CVSS
6.1

_{Affected system
type}
BI/BO platform

_Patchday
2020-07

_{Released
on}
2020/07/14

_{Related note}
2874738

_CVSS
3.8

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

_{Related note}
2912708

_CVSS
5.4

_{Affected system
type}
BI/BO platform

_Patchday
2020-07

_{Released
on}
2020/07/14

_{Related note}
2917743

_CVSS
6.1

_{Affected system
type}
BI/BO platform

_Patchday
2020-07

_{Released
on}
2020/07/14

_{Related note}
2091403

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2015/08/11

_{Related note}
2603398

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

_{Related note}
2758000

_CVSS
6.3

_{Affected system
type}
SAP Disclosure Management

_Patchday
2020-07

_{Released
on}
2020/07/14

_{Related note}
2537961

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

_{Related note}
2847817

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

_{Related note}
2927373

_CVSS
2.7

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

_{Related note}
2934135

_CVSS
10.0

_{Affected system
type}
Java

_Patchday
2020-07

_{Released
on}
2020/07/14

_{Related note}
2896025

_CVSS
5.8

_{Affected system
type}
Java

_Patchday
2020-07

_{Released
on}
2020/07/14

_{Related note}
2486446

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

_{Related note}
2932473

_CVSS
7.7

_{Affected system
type}
Java

_Patchday
2020-07

_{Released
on}
2020/07/14