Security Advisories

We've created the first of its kind, SecurityBridge ^{Cloud Platform} to prioritize SAP patches, updates and the remediation strategies essential for preventing the disruption of vital business systems. Our security advisories enable SAP users to understand the security and business implications of running SAP.

The user interface, is designed to be as intuitive as possible but we'd love to hear your feedback and opinions.
We hope you like it!

× Yikes, there is work to do!
This time we found critical correction advisiories. We count 16 and the highest CVSS score is 10.0.

Severity

SAP© Security advisories 16

System Types

Affected SAP© system types

_{Related note}
2938831

_CVSS
6.0

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/06/23

Description
SESS: Duplicate AU3 entries in the Security Audit Log

Security Advisory

_{Related note}
2541823

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/06/09

Description
Switchable authorization checks for RFC in SAP CRM (external billing)

Security Advisory

_{Related note}
2849967

_CVSS
6.1

_{Affected system
type}
BI/BO platform

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
[CVE-2020-6276] Cross-Site Scripting (XSS) vulnerability in SAP Business Objects Business Intelligence Platform(Bipodata)

Security Advisory

_{Related note}
2874738

_CVSS
3.8

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
Missing Authorization Check in S4 ACR Brazil Option

Security Advisory

_{Related note}
2912708

_CVSS
5.4

_{Affected system
type}
BI/BO platform

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
[CVE-2020-6278] Cross-Site Scripting (XSS) vulnerability in SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC)

Security Advisory

_{Related note}
2917743

_CVSS
6.1

_{Affected system
type}
BI/BO platform

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
[CVE-2020-6281] Cross-Site Scripting (XSS) vulnerability in SAP Business Objects Business Intelligence Platform(BI Launch pad)

Security Advisory

_{Related note}
2091403

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2015/08/11

Description
Directory traversal in BC-MID-ICF

Security Advisory

_{Related note}
2603398

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
Missing authorization check in Allocation Management

Security Advisory

_{Related note}
2758000

_CVSS
6.3

_{Affected system
type}
SAP Disclosure Management

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
[CVE-2020-6267] Multiple vulnerabilities in SAP Disclosure Management

Security Advisory

_{Related note}
2537961

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
Switchable Authorization checks for RFC in MM-PUR-GF

Security Advisory

_{Related note}
2847817

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
Missing Authorization check in Travel Management

Security Advisory

_{Related note}
2927373

_CVSS
2.7

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
[CVE-2020-6280] Information Disclosure in SAP NetWeaver (ABAP Server) and ABAP Platform

Security Advisory

_{Related note}
2934135

_CVSS
10.0

_{Affected system
type}
Java

Exploit available

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
[CVE-2020-6287] Multiple Vulnerabilities in SAP NetWeaver AS JAVA (LM Configuration Wizard)

Security Advisory

_{Related note}
2896025

_CVSS
5.8

_{Affected system
type}
Java

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
[CVE-2020-6282] Server-Side Request Forgery in SAP NetWeaver AS JAVA (IIOP service)

Security Advisory

_{Related note}
2486446

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
Missing Authorization check in Pricat Inbound and Pricat Outbound

Security Advisory

_{Related note}
2932473

_CVSS
7.7

_{Affected system
type}
Java

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
[CVE-2020-6285] Information Disclosure in SAP NetWeaver (XMLToolkit for Java)

Security Advisory

Notifications

Security Advisories

Severity

SAP© Security advisories 16

System Types

Affected SAP© system types

Related note 2938831

CVSS 6.0

Affected system type ABAP

Patchday2020-07

Released on2020/06/23

Related note 2541823

CVSS 6.3

Affected system type ABAP

Patchday2020-07

Released on2020/06/09

Related note 2849967

CVSS 6.1

Affected system type BI/BO platform

Patchday2020-07

Released on2020/07/14

Related note 2874738

CVSS 3.8

Affected system type ABAP

Patchday2020-07

Released on2020/07/14

Related note 2912708

CVSS 5.4

Affected system type BI/BO platform

Patchday2020-07

Released on2020/07/14

Related note 2917743

CVSS 6.1

Affected system type BI/BO platform

Patchday2020-07

Released on2020/07/14

Related note 2091403

CVSS 6.3

Affected system type ABAP

Patchday2020-07

Released on2015/08/11

Related note 2603398

CVSS 6.3

Affected system type ABAP

Patchday2020-07

Released on2020/07/14

Related note 2758000

CVSS 6.3

Affected system type SAP Disclosure Management

Patchday2020-07

Released on2020/07/14

Related note 2537961

CVSS 6.3

Affected system type ABAP

Patchday2020-07

Released on2020/07/14

Related note 2847817

CVSS 4.3

Affected system type ABAP

Patchday2020-07

Released on2020/07/14

Related note 2927373

CVSS 2.7

Affected system type ABAP

Patchday2020-07

Released on2020/07/14

Related note 2934135

CVSS 10.0

Affected system type Java

Exploit available

Patchday2020-07

Released on2020/07/14

Related note 2896025

CVSS 5.8

Affected system type Java

Patchday2020-07

Released on2020/07/14

Related note 2486446

CVSS 6.3

Affected system type ABAP

_{Related note}
2938831

_CVSS
6.0

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/06/23

_{Related note}
2541823

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/06/09

_{Related note}
2849967

_CVSS
6.1

_{Affected system
type}
BI/BO platform

_Patchday
2020-07

_{Released
on}
2020/07/14

_{Related note}
2874738

_CVSS
3.8

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

_{Related note}
2912708

_CVSS
5.4

_{Affected system
type}
BI/BO platform

_Patchday
2020-07

_{Released
on}
2020/07/14

_{Related note}
2917743

_CVSS
6.1

_{Affected system
type}
BI/BO platform

_Patchday
2020-07

_{Released
on}
2020/07/14

_{Related note}
2091403

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2015/08/11

_{Related note}
2603398

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

_{Related note}
2758000

_CVSS
6.3

_{Affected system
type}
SAP Disclosure Management

_Patchday
2020-07

_{Released
on}
2020/07/14

_{Related note}
2537961

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

_{Related note}
2847817

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

_{Related note}
2927373

_CVSS
2.7

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

_{Related note}
2934135

_CVSS
10.0

_{Affected system
type}
Java

_Patchday
2020-07

_{Released
on}
2020/07/14

_{Related note}
2896025

_CVSS
5.8

_{Affected system
type}
Java

_Patchday
2020-07

_{Released
on}
2020/07/14

_{Related note}
2486446

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

_{Related note}
2932473

_CVSS
7.7

_{Affected system
type}
Java

_Patchday
2020-07

_{Released
on}
2020/07/14