Security Advisories for SAP©

Security Advisories

We've created the first of its kind, SecurityBridge ^{Cloud Platform} to prioritize SAP patches, updates and the remediation strategies essential for preventing the disruption of vital business systems. Our security advisories enable SAP users to understand the security and business implications of running SAP.

The user interface, is designed to be as intuitive as possible but we'd love to hear your feedback and opinions.
We hope you like it!

× Yikes, there is work to do!
This time we found critical correction advisiories. We count 55 and the highest CVSS score is 9.9.

Severity

SAP© Security advisories 55

System Types

Affected SAP© system types

_{Related note}
2911863

_CVSS
5.3

_{Affected system
type}
BI/BO platform

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
Information Disclosure in BOE/CMC application

Security Advisory

_{Related note}
2818965

_CVSS
4.6

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
Clickjacking vulnerability in Runtime Workbench of SAP Process Integration

Security Advisory

_{Related note}
3005802

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2021-04

_{Released
on}
2021/03/23

Description
Cross-Site Request Forgery (CSRF) vulnerability in S/4HANA Finance for advanced payment management

Security Advisory

_{Related note}
3001824

_CVSS
7.4

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-21485] Information Disclosure in SAP NetWeaver AS for Java (Telnet Commands)

Security Advisory

_{Related note}
3030948

_CVSS
4.6

_{Affected system
type}
SAP Solution Manager...

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27609] Missing Authorization check in SAP Focused RUN

Security Advisory

_{Related note}
3024414

_CVSS
6.4

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27600 ] Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Execution (System Rules)

Security Advisory

_{Related note}
3039649

_CVSS
7.5

_{Affected system
type}
SAP GUI / Frontend

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27608] Unquoted Search Path in SAPSetup

Security Advisory

_{Related note}
3017823

_CVSS
8.2

_{Affected system
type}
SAP Solution Manager

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-21483] Information Disclosure in SAP Solution Manager

Security Advisory

_{Related note}
3040210

_CVSS
9.9

_{Affected system
type}
SAP Commerce / SAP...

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27602] Remote Code Execution vulnerability in Source Rules of SAP Commerce

Security Advisory

_{Related note}
2963592

_CVSS
5.4

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27601] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS Java (Applications based on HTMLB for Java)

Security Advisory

_{Related note}
3036436

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27604] Potential XXE Vulnerability in SAP Process Integration (ESR Java Mappings)

Security Advisory

_{Related note}
3017908

_CVSS
8.3

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-21482] Information Disclosure in SAP NetWeaver Master Data Management

Security Advisory

_{Related note}
3028729

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27603] Denial of Service (DoS) in SAP NetWeaver AS of ABAP

Security Advisory

_{Related note}
3025637

_CVSS
4.3

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-21492] Content spoofing in NetWeaver AS Java HTTP Service

Security Advisory

_{Related note}
3012277

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27599] Information Disclosure in SAP Process Integration (Integration Builder Framework)

Security Advisory

_{Related note}
3036679

_CVSS
5.3

_{Affected system
type}
ABAP

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
Update 1 to Security Note 1576763: Potential information disclosure relating to usernames

Security Advisory

_{Related note}
3027937

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27598] Improper Access Control in SAP NetWeaver AS for Java (Customer Usage Provisioning Servlet)

Security Advisory

_{Related note}
3035472

_CVSS
4.3

_{Affected system
type}
SAP 3D Visual Enterprise

_Patchday
2021-04

_{Released
on}
2021/03/18

Description
[Multiple CVEs] Improper Input Validation in SAP 3D Visual Enterprise Viewer

Security Advisory

_{Related note}
3025054

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27605 ] Missing Authorization check in HCM Travel Management Fiori Apps V2

Security Advisory

_{Related note}
2983436

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
[CVE-2021-21488] Insecure deserialisation in SAP NetWeaver Knowledge Management

Security Advisory

_{Related note}
2475705

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2021-03

_{Released
on}
2021/02/23

Description
Switchable Authorization checks for RFC in In House Cash

Security Advisory

_{Related note}
2976947

_CVSS
4.7

_{Affected system
type}
Java

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
[CVE-2021-21491] Reverse TabNabbing vulnerability in SAP NetWeaver Application Server Java (Applications based on Web Dynpro Java)

Security Advisory

_{Related note}
2977001

_CVSS
4.7

_{Affected system
type}
Java

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
Reverse TabNabbing vulnerability in SAP NetWeaver Application Server Java (Applications based on HTMLB for Java)

Security Advisory

_{Related note}
3027767

_CVSS
4.3

_{Affected system
type}
SAP 3D Visual Enterprise

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
[CVE-2021-27592] Improper Input Validation in SAP 3D Visual Enterprise Viewer

Security Advisory

_{Related note}
3022622

_CVSS
9.9

_{Affected system
type}
Java

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
[CVE-2021-21480] Code injection vulnerability in SAP Manufacturing Integration and Intelligence

Security Advisory

_{Related note}
3017378

_CVSS
7.7

_{Affected system
type}
SAP HANA Platform

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
[CVE-2021-21484] Possible authentication bypass in SAP HANA LDAP scenarios

Security Advisory

_{Related note}
3027758

_CVSS
4.3

_{Affected system
type}
SAP 3D Visual Enterprise

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
[Multiple CVEs] Improper Input Validation in SAP 3D Visual Enterprise Viewer

Security Advisory

_{Related note}
3023778

_CVSS
6.8

_{Affected system
type}
ABAP

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
[CVE-2021-21487] Missing Authorization Check in Payment Engine

Security Advisory

_{Related note}
3007888

_CVSS
6.8

_{Affected system
type}
ABAP

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
[CVE-2021-21486] Missing Authorization check in SAP Enterprise Financial Services( Bank Customer Accounts )

Security Advisory

_{Related note}
2978151

_CVSS
4.7

_{Affected system
type}
Java

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
Reverse tabnabbing issue in Unified Rendering based frameworks in NetWeaver Application Server Java

Security Advisory

_{Related note}
3022422

_CVSS
9.6

_{Affected system
type}
Java

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
[CVE-2021-21481] Missing Authorization Check in SAP NetWeaver AS JAVA (MigrationService)

Security Advisory

_{Related note}
2835240

_CVSS
5.4

_{Affected system
type}
Java

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
Clickjacking vulnerability in Cloud Integration Content of SAP Process Integration

Security Advisory

_{Related note}
2994289

_CVSS
4.1

_{Affected system
type}
ABAP

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
Reverse Tabnabbing vulnerability within SAP CRM WebClient UI

Security Advisory

_{Related note}
3000897

_CVSS
4.0

_{Affected system
type}
Java

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
[CVE-2021-21475] Directory Traversal vulnerability in SAP NetWeaver Master Data Management 7.1

Security Advisory

_{Related note}
2990992

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
Missing Authorization Checks in the Monitor Data and My Data Collections Apps

Security Advisory

_{Related note}
2935791

_CVSS
5.4

_{Affected system
type}
BI/BO platform

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
[CVE-2021-21444] Clickjacking vulnerability in SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad)

Security Advisory

_{Related note}
2998173

_CVSS
6.3

_{Affected system
type}
SAP Netweaver

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
[CVE-2021-21472] Server password not set during installation of SAP NetWeaver Master Data Management 7.1

Security Advisory

_{Related note}
2992154

_CVSS
4.1

_{Affected system
type}
SAP HANA Platform

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
[CVE-2021-21474] SAML Assertion Signature MD5 Digest Algorithm Vulnerability in SAP HANA Database

Security Advisory

_{Related note}
3014121

_CVSS
9.9

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
[CVE-2021-21477] Remote Code Execution vulnerability in SAP Commerce

Security Advisory

_{Related note}
2973428

_CVSS
4.7

_{Affected system
type}
Kernal

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
Reverse Tabnabbing vulnerability within SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)

Security Advisory

_{Related note}
2974582

_CVSS
4.7

_{Affected system
type}
ABAP

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
[CVE-2021-21478] Reverse Tabnabbing vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Web Dynpro ABAP)

Security Advisory

_{Related note}
2818963

_CVSS
0.0

_{Affected system
type}
Java

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
Clickjacking vulnerability in Adapter Runtime of SAP Process Integration

Security Advisory

_{Related note}
3002617

_CVSS
4.3

_{Affected system
type}
Visual Enterprise

_Patchday
2021-01

_{Released
on}
2021/01/12

Description
[Multiple CVEs] Improper Input Validation in SAP 3D Visual Enterprise Viewer

Security Advisory

_{Related note}
2999854

_CVSS
9.9

_{Affected system
type}
ABAP

_Patchday
2021-01

_{Released
on}
2021/01/12

Description
[CVE-2021-21466] Code Injection in SAP Business Warehouse and SAP BW/4HANA

Security Advisory

_{Related note}
2992269

_CVSS
5.3

_{Affected system
type}
SAP GUI / Frontend

_Patchday
2021-01

_{Released
on}
2021/01/12

Description
[CVE-2021-21448] Information Disclosure in SAP GUI for Windows

Security Advisory

_{Related note}
2984034

_CVSS
5.4

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2021-01

_{Released
on}
2021/01/12

Description
[CVE-2021-21445] Header Manipulation vulnerability in SAP Commerce Cloud

Security Advisory

_{Related note}
3000291

_CVSS
3.6

_{Affected system
type}
Analysis for Office

_Patchday
2021-01

_{Released
on}
2021/01/12

Description
[CVE-2021-21470] XML External Entity vulnerability in SAP EPM add-in

Security Advisory

_{Related note}
2965154

_CVSS
5.4

_{Affected system
type}
BI/BO platform

_Patchday
2021-01

_{Released
on}
2021/01/12

Description
[CVE-2021-21447] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)

Security Advisory

_{Related note}
2986980

_CVSS
9.9

_{Affected system
type}
ABAP

_Patchday
2021-01

_{Released
on}
2021/01/12

Description
[CVE-2021-21465] Multiple vulnerabilities in SAP Business Warehouse (Database Interface)

Security Advisory

_{Related note}
3000306

_CVSS
7.5

_{Affected system
type}
ABAP

_Patchday
2021-01

_{Released
on}
2021/01/12

Description
[CVE-2021-21446] Denial of service (DOS) in SAP NetWeaver AS ABAP and ABAP Platform

Security Advisory

_{Related note}
2743329

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2021-01

_{Released
on}
2021/01/12

Description
Switchable authorization checks for RFC module in In-House-Cash.

Security Advisory

_{Related note}
3001373

_CVSS
8.9

_{Affected system
type}
Cloud Foundry

_Patchday
2021-01

_{Released
on}
2020/12/22

Description
Information Disclosure in Central Order

Security Advisory

_{Related note}
2665387

_CVSS
5.5

_{Affected system
type}
ABAP

_Patchday
2021-01

_{Released
on}
2021/01/12

Description
Cross-Site Request Forgery (CSRF) vulnerability in Cash Management

Security Advisory

_{Related note}
3008422

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2021-01

_{Released
on}
2021/01/12

Description
[CVE-2021-21467] Missing Authorization check in SAP Banking Services (Generic Market Data)

Security Advisory

_{Related note}
2993032

_CVSS
5.3

_{Affected system
type}
Java

_Patchday
2021-01

_{Released
on}
2021/01/12

Description
[CVE-2021-21469] Information Disclosure in SAP NetWeaver Master Data Management

Security Advisory

Notifications