Security Advisories

We've created the first of its kind, SecurityBridge ^{Cloud Platform} to prioritize SAP patches, updates and the remediation strategies essential for preventing the disruption of vital business systems. Our security advisories enable SAP users to understand the security and business implications of running SAP.

The user interface, is designed to be as intuitive as possible but we'd love to hear your feedback and opinions.
We hope you like it!

× Yikes, there is work to do!
This time we found critical correction advisiories. We count 179 and the highest CVSS score is 10.0.

Severity

SAP© Security advisories 179

System Types

Affected SAP© system types

_{Related note}
3114134

_CVSS
8.8

_{Affected system
type}
SAP Commerce

_Patchday
2021-12

_{Released
on}
2021/12/14

Description
[CVE-2021-42064] SQL Injection vulnerability in SAP Commerce

Security Advisory

_{Related note}
3132198

_CVSS
9.8

_{Affected system
type}
SAP Landscape...

_Patchday
2021-12

_{Released
on}
2021/12/20

Description
[CVE-2019-17571] Code Injection vulnerability in SAP Landscape Management

Security Advisory

_{Related note}
3132822

_CVSS
9.0

_{Affected system
type}
SAP HANA Platform

_Patchday
2021-12

_{Released
on}
2021/12/21

Description
Update 1 to Security Note 3131397 [CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in XSA Cockpit

Security Advisory

_{Related note}
3132744

_CVSS
10.0

_{Affected system
type}
SAP BTP Kyma runtime

_Patchday
2021-12

_{Released
on}
2021/12/21

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP BTP Kyma

Security Advisory

_{Related note}
3132074

_CVSS
8.0

_{Affected system
type}
SAP Cloud for Customer

_Patchday
2021-12

_{Released
on}
2021/12/23

Description
[CVE-2021-44228] Code Injection vulnerability in Cloud for Customer Lotus Notes PlugIn

Security Advisory

_{Related note}
2460948

_CVSS
5.3

_{Affected system
type}
ABAP

_Patchday
2021-12

_{Released
on}
2021/11/23

Description
Missing Authorization Check in Vehicle Management System

Security Advisory

_{Related note}
3132922

_CVSS
10.0

_{Affected system
type}
SAP Edge Services

_Patchday
2021-12

_{Released
on}
2021/12/21

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in Internet of Things Edge Platform

Security Advisory

_{Related note}
3121165

_CVSS
4.3

_{Affected system
type}
SAP 3D Visual Enterprise

_Patchday
2021-12

_{Released
on}
2021/12/14

Description
[Multiple CVEs] Improper Input Validation in SAP 3D Visual Enterprise Viewer

Security Advisory

_{Related note}
3132162

_CVSS
10.0

_{Affected system
type}
SAP API Management

_Patchday
2021-12

_{Released
on}
2021/12/24

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP BTP API Management (Tenant Cloning Tool)

Security Advisory

_{Related note}
3102769

_CVSS
8.8

_{Affected system
type}
Java

_Patchday
2021-12

_{Released
on}
2021/12/14

Description
[CVE-2021-42063] Cross-Site Scripting (XSS) vulnerability in SAP Knowledge Warehouse

Security Advisory

_{Related note}
3132964

_CVSS
10.0

_{Affected system
type}
SAP Enable Now

_Patchday
2021-12

_{Released
on}
2021/12/23

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP Enable Now Manager

Security Advisory

_{Related note}
3113593

_CVSS
7.5

_{Affected system
type}
SAP Commerce

_Patchday
2021-12

_{Released
on}
2021/12/14

Description
Denial of service (DOS) in SAP Commerce

Security Advisory

_{Related note}
3109577

_CVSS
9.9

_{Affected system
type}
SAP Commerce

_Patchday
2021-12

_{Released
on}
2021/12/14

Description
Code Execution vulnerability in SAP Commerce, localization for China

Security Advisory

_{Related note}
3130521

_CVSS
9.9

_{Affected system
type}
Java

_Patchday
2021-12

_{Released
on}
2021/12/16

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in Java Web Service Adapter of SAP NetWeaver Process Integration

Security Advisory

_{Related note}
2484231

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2021-12

_{Released
on}
2021/12/14

Description
Missing Authorization Check in DIMP Industry Solution (Equipment and Tools Management & Bills of Services)

Security Advisory

_{Related note}
3103677

_CVSS
4.1

_{Affected system
type}
BI/BO platform

_Patchday
2021-12

_{Released
on}
2021/12/14

Description
[CVE-2021-42061] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence platform (Web Intelligence)

Security Advisory

_{Related note}
3051005

_CVSS
3.5

_{Affected system
type}
SAP UI5

_Patchday
2021-12

_{Released
on}
2021/12/14

Description
Cross-Site Scripting (XSS) Vulnerability in SAP Fiori Launchpad

Security Advisory

_{Related note}
3080816

_CVSS
2.4

_{Affected system
type}
ABAP

_Patchday
2021-12

_{Released
on}
2021/12/14

Description
[CVE-2021-44233] Missing Authorization check in GRC Access Control

Security Advisory

_{Related note}
3131824

_CVSS
8.0

_{Affected system
type}
SAP Connected Health platform

_Patchday
2021-12

_{Released
on}
2021/12/20

Description
[CVE-2021-44228] Log4j Vulnerability in Connected Health Platform 2.0 - Fhirserver

Security Advisory

_{Related note}
3119365

_CVSS
9.9

_{Affected system
type}
ABAP

_Patchday
2021-12

_{Released
on}
2021/12/14

Description
[CVE-2021-44231] Code Injection vulnerability in SAP ABAP Server & ABAP Platform (Translation Tools)

Security Advisory

_{Related note}
2661033

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2021-12

_{Released
on}
2021/11/23

Description
Missing Authorization check in RFC enabled function modules in SRM

Security Advisory

_{Related note}
3124094

_CVSS
7.7

_{Affected system
type}
ABAP

_Patchday
2021-12

_{Released
on}
2021/12/14

Description
[CVE-2021-44232] Directory Traversal vulnerability in SAF-T Framework

Security Advisory

_{Related note}
3123196

_CVSS
8.4

_{Affected system
type}
ABAP

_Patchday
2021-12

_{Released
on}
2021/12/14

Description
[CVE-2021-44235] Code Injection vulnerability in utility class for SAP NetWeaver AS ABAP

Security Advisory

_{Related note}
3131047

_CVSS
10.0

_{Affected system
type}
Any

_Patchday
2021-12

_{Released
on}
2021/12/15

Description
[CVE-2021-44228] Central Security Note for Remote Code Execution vulnerability associated with Apache Log4j 2 component

Security Advisory

_{Related note}
3107332

_CVSS
6.6

_{Affected system
type}
SAP Landscape Management

_Patchday
2021-12

_{Released
on}
2021/12/14

Description
Missing Authorization Check in SAP Landscape Management

Security Advisory

_{Related note}
3131397

_CVSS
10.0

_{Affected system
type}
SAP HANA Platform

_Patchday
2021-12

_{Released
on}
2021/12/17

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in XSA Cockpit

Security Advisory

_{Related note}
3131258

_CVSS
10.0

_{Affected system
type}
SAP HANA Platform

_Patchday
2021-12

_{Released
on}
2021/12/16

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP HANA XSA

Security Advisory

_{Related note}
3133772

_CVSS
10.0

_{Affected system
type}
SAP Customer Checkout

_Patchday
2021-12

_{Released
on}
2021/12/22

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP Customer Checkout

Security Advisory

_{Related note}
3130578

_CVSS
10.0

_{Affected system
type}
SAP BTP Cloud Foundry runtime

_Patchday
2021-12

_{Released
on}
2021/12/21

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP BTP Cloud Foundry

Security Advisory

_{Related note}
3132909

_CVSS
10.0

_{Affected system
type}
SAP Edge Services

_Patchday
2021-12

_{Released
on}
2021/12/24

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP Edge Services On Premise Edition

Security Advisory

_{Related note}
3132204

_CVSS
3.1

_{Affected system
type}
Java

_Patchday
2021-12

_{Released
on}
2021/12/16

Description
Update 1 to Security Note 3130521: [CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in Java Web Service Adapter of SAP NetWeaver Process Integration

Security Advisory

_{Related note}
3105728

_CVSS
4.9

_{Affected system
type}
ABAP

_Patchday
2021-11

_{Released
on}
2021/11/09

Description
[CVE-2021-40504] Leverage of Permission in SAP NetWeaver Application Server for ABAP and ABAP Platform

Security Advisory

_{Related note}
3080106

_CVSS
6.8

_{Affected system
type}
SAP GUI / Frontend

_Patchday
2021-11

_{Released
on}
2021/11/09

Description
[CVE-2021-40503] Information Disclosure in SAP GUI for Windows

Security Advisory

_{Related note}
3110328

_CVSS
8.3

_{Affected system
type}
SAP Commerce

_Patchday
2021-11

_{Released
on}
2021/11/09

Description
[CVE-2021-40502] Missing Authorization check in SAP Commerce

Security Advisory

_{Related note}
2827086

_CVSS
7.9

_{Affected system
type}
SAP FRP

_Patchday
2021-11

_{Released
on}
2021/11/09

Description
Several security vulnerabilities in FRP 5.4.0 and FR Engine 5.4.0

Security Advisory

_{Related note}
3099776

_CVSS
9.6

_{Affected system
type}
Kernel

_Patchday
2021-11

_{Released
on}
2021/11/09

Description
[CVE-2021-40501] Missing Authorization check in ABAP Platform Kernel

Security Advisory

_{Related note}
3104456

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2021-11

_{Released
on}
2021/11/09

Description
[CVE-2021-42062] Missing Authorization check in SAP ERP HCM

Security Advisory

_{Related note}
3106859

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2021-11

_{Released
on}
2021/11/09

Description
URL Redirection vulnerability in Offer Management

Security Advisory

_{Related note}
2607126

_CVSS
6.3

_{Affected system
type}
Java

_Patchday
2021-11

_{Released
on}
2021/11/09

Description
Cross-Site Request Forgery vulnerability in Enterprise Services Repository of SAP Process Integration

Security Advisory

_{Related note}
3074819

_CVSS
6.7

_{Affected system
type}
SAP Business One

_Patchday
2021-10

_{Released
on}
2021/10/12

Description
[CVE-2021-38179] Information Disclosure in SAP Business One

Security Advisory

_{Related note}
3098917

_CVSS
4.3

_{Affected system
type}
BI/BO platform

_Patchday
2021-10

_{Released
on}
2021/10/12

Description
[CVE-2021-40497] Information Disclosure in SAP BusinessObjects Analysis (edition for OLAP)

Security Advisory

_{Related note}
3077635

_CVSS
7.8

_{Affected system
type}
SAP Success Factors

_Patchday
2021-10

_{Released
on}
2021/10/12

Description
[CVE-2021-40498] Denial of service (DOS) in the SAP SuccessFactors Mobile Application for Android devices

Security Advisory

_{Related note}
3097887

_CVSS
9.1

_{Affected system
type}
ABAP

_Patchday
2021-10

_{Released
on}
2021/10/12

Description
[CVE-2021-38178] Improper Authorization in SAP NetWeaver AS ABAP and ABAP Platform

Security Advisory

_{Related note}
2655294

_CVSS
5.3

_{Affected system
type}
ABAP

_Patchday
2021-10

_{Released
on}
2021/10/12

Description
Missing Authorization check in SCM BAPIs

Security Advisory

_{Related note}
3055347

_CVSS
6.1

_{Affected system
type}
SAP UI5

_Patchday
2021-10

_{Released
on}
2021/10/12

Description
Cross-Site Scripting (XSS) vulnerability in SAPUI5

Security Advisory

_{Related note}
3084937

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2021-10

_{Released
on}
2021/10/12

Description
[CVE-2021-38183] Cross-Site Scripting (XSS) vulnerability in cms Service of SAP NetWeaver

Security Advisory

_{Related note}
3100882

_CVSS
6.4

_{Affected system
type}
SAP Cloud Print Manager

_Patchday
2021-10

_{Released
on}
2021/10/12

Description
[CVE-2021-40499] Code Injection vulnerability for SAP NetWeaver Application Server for ABAP (SAP Cloud Print Manager and SAPSprint)

Security Advisory

_{Related note}
3101406

_CVSS
9.8

_{Affected system
type}
Java

_Patchday
2021-10

_{Released
on}
2021/10/12

Description
Potential XML External Entity Injection Vulnerability in SAP Environmental Compliance

Security Advisory

_{Related note}
3099011

_CVSS
5.3

_{Affected system
type}
ABAP

_Patchday
2021-10

_{Released
on}
2021/10/12

Description
[CVE-2021-40495] Denial of Service (DOS) in SAP NetWeaver Application Server for ABAP and ABAP Platform

Security Advisory

_{Related note}
2988962

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2021-10

_{Released
on}
2021/09/28

Description
Cross-Site Request Forgery (CSRF) vulnerability for S/4HANA OP2020, OP1909 in Import Financial Plan Data

Security Advisory

_{Related note}
3074693

_CVSS
6.9

_{Affected system
type}
BI/BO platform

_Patchday
2021-10

_{Released
on}
2021/10/12

Description
[CVE-2021-40500] Missing XML Validation in SAP BusinessObjects Business Intelligence Platform (Crystal Reports)

Security Advisory

_{Related note}
3087254

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2021-10

_{Released
on}
2021/10/12

Description
[CVE-2021-40496] Improper Access Control in SAP NetWeaver AS ABAP and ABAP Platform

Security Advisory

_{Related note}
2988956

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2021-10

_{Released
on}
2021/09/28

Description
Cross-Site Request Forgery (CSRF) vulnerability in S/4HANA OP2020, OP1909 in Import Financial Plan Data

Security Advisory

_{Related note}
3079427

_CVSS
6.5

_{Affected system
type}
SAP Business One

_Patchday
2021-10

_{Released
on}
2021/10/12

Description
[CVE-2021-38180] CSV Injection in SAP Business One

Security Advisory

_{Related note}
3089438

_CVSS
9.1

_{Affected system
type}
ABAP

_Patchday
2021-10

_{Released
on}
2021/09/20

Description
Missing transaction start (AU3) entries in the Security Audit Log

Security Advisory

_{Related note}
3080710

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2021-10

_{Released
on}
2021/10/12

Description
[CVE-2021-38181] Denial of service (DOS) in SAP NetWeaver AS ABAP and ABAP Platform

Security Advisory

_{Related note}
3051787

_CVSS
7.5

_{Affected system
type}
ABAP Java HANA platform

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-38177] Null Pointer Dereference vulnerability in SAP CommonCryptoLib

Security Advisory

_{Related note}
3084487

_CVSS
9.9

_{Affected system
type}
Java

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-38163] Unrestricted File Upload vulnerability in SAP NetWeaver (Visual Composer 7.0 RT)

Security Advisory

_{Related note}
3087791

_CVSS
4.3

_{Affected system
type}
SAP 3D Visual Enterprise

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-38174] Improper Input Validation in SAP 3D Visual Enterprise Viewer

Security Advisory

_{Related note}
3055180

_CVSS
5.4

_{Affected system
type}
BI/BO platform

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-33679] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (BI Workspace)

Security Advisory

_{Related note}
3089831

_CVSS
9.9

_{Affected system
type}
ABAP

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-38176] SQL Injection vulnerability in SAP NZDT Mapping Table Framework

Security Advisory

_{Related note}
3068337

_CVSS
3.5

_{Affected system
type}
ABAP

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
Reverse tabnabbing vulnerability in SAP Marketing Lead Nurture Stream

Security Advisory

_{Related note}
3069032

_CVSS
6.5

_{Affected system
type}
SAP Business One

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-33685] Directory Traversal vulnerability in SAP Business One

Security Advisory

_{Related note}
3078609

_CVSS
10.0

_{Affected system
type}
Java

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-37535] Missing Authorization check in SAP NetWeaver Application Server for Java (JMS Connector Service)

Security Advisory

_{Related note}
3070138

_CVSS
5.3

_{Affected system
type}
SAP Business One

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-33686] Information Disclosure in SAP Business One

Security Advisory

_{Related note}
3080567

_CVSS
8.9

_{Affected system
type}
Kernel

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-38162] HTTP Request Smuggling in SAP Web Dispatcher

Security Advisory

_{Related note}
3081888

_CVSS
9.9

_{Affected system
type}
Java

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-37531] Code Injection vulnerability in SAP NetWeaver Knowledge Management (XMLForms)

Security Advisory

_{Related note}
3068582

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-38164] Missing Authorization check in in SAP ERP Financial Accounting / RFOPENPOSTING_FR

Security Advisory

_{Related note}
3069882

_CVSS
4.3

_{Affected system
type}
SAP Business One

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-33688] SQL Injection vulnerability in SAP Business One

Security Advisory

_{Related note}
3082500

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-38175] Information Disclosure in SAP Analysis for Microsoft Office

Security Advisory

_{Related note}
3082219

_CVSS
4.8

_{Affected system
type}
Java

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-21489] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal

Security Advisory

_{Related note}
2308378

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
Missing Authorization check in Financial Accounting

Security Advisory

_{Related note}
3075546

_CVSS
4.3

_{Affected system
type}
SAP Business One

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-37532] Directory Listing Enabled in SAP Business One

Security Advisory

_{Related note}
3073891

_CVSS
9.6

_{Affected system
type}
BCM platform

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-33672] Multiple vulnerabilities in SAP Contact Center

Security Advisory

_{Related note}
3060621

_CVSS
6.1

_{Affected system
type}
SAP GUI / Frontend

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-38150] Information disclosure in SAP Business Client

Security Advisory

_{Related note}
3072955

_CVSS
9.9

_{Affected system
type}
Java

_Patchday
2021-08

_{Released
on}
2021/08/10

Description
[CVE-2021-33690] Server Side Request Forgery vulnerability in SAP NetWeaver Development Infrastructure (Component Build Service)

Security Advisory

_{Related note}
3071984

_CVSS
9.9

_{Affected system
type}
SAP Business One

_Patchday
2021-08

_{Released
on}
2021/08/10

Description
[CVE-2021-33698] Unrestricted File Upload vulnerability in SAP Business One

Security Advisory

_{Related note}
3073681

_CVSS
8.3

_{Affected system
type}
Java

_Patchday
2021-08

_{Released
on}
2021/08/10

Description
[CVE-2021-33702] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal

Security Advisory

_{Related note}
3078072

_CVSS
6.3

_{Affected system
type}
SAP Business One

_Patchday
2021-08

_{Released
on}
2021/08/10

Description
[CVE-2021-33704] Missing Authorization Check in SAP Business One (Service Layer)

Security Advisory

_{Related note}
2675775

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2021-08

_{Released
on}
2021/08/10

Description
Switchable Authorization checks for RFC in CRM Middleware

Security Advisory

_{Related note}
3073450

_CVSS
6.9

_{Affected system
type}
Java

_Patchday
2021-08

_{Released
on}
2021/08/10

Description
[CVE-2021-33691] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Development Infrastructure (Notification Service)

Security Advisory

_{Related note}
3062085

_CVSS
5.4

_{Affected system
type}
BI/BO platform

_Patchday
2021-08

_{Released
on}
2021/08/10

Description
[CVE-2021-33696] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Crystal Report)

Security Advisory

_{Related note}
3072920

_CVSS
8.3

_{Affected system
type}
Java

_Patchday
2021-08

_{Released
on}
2021/08/10

Description
[CVE-2021-33703] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal

Security Advisory

_{Related note}
2659604

_CVSS
6.4

_{Affected system
type}
ABAP

_Patchday
2021-08

_{Released
on}
2021/07/27

Description
Cross-Site Scripting (XSS) Vulnerability in BSP application CRM_CM

Security Advisory

_{Related note}
3073325

_CVSS
7.0

_{Affected system
type}
SAP Business One

_Patchday
2021-08

_{Released
on}
2021/08/10

Description
[CVE-2021-33700] Missing Authentication check in SAP Business One

Security Advisory

_{Related note}
3076399

_CVSS
6.1

_{Affected system
type}
Java

_Patchday
2021-08

_{Released
on}
2021/08/10

Description
[CVE-2021-33707] URL Redirection vulnerability in SAP NetWeaver (Knowledge Management)

Security Advisory

_{Related note}
3057378

_CVSS
8.8

_{Affected system
type}
Kernel

_Patchday
2021-08

_{Released
on}
2021/08/10

Description
Missing Authentication check in SAP Web Dispatcher

Security Advisory

_{Related note}
3002517

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2021-08

_{Released
on}
2021/06/08

Description
[CVE-2021-21473] Missing Authorization check in SAP NetWeaver AS ABAP and ABAP Platform

Security Advisory

_{Related note}
3078312

_CVSS
9.1

_{Affected system
type}
ABAP

_Patchday
2021-08

_{Released
on}
2021/08/10

Description
[CVE-2021-33701] SQL Injection vulnerability in SAP NZDT Row Count Reconciliation

Security Advisory

_{Related note}
3058553

_CVSS
6.8

_{Affected system
type}
SAP Cloud Connector

_Patchday
2021-08

_{Released
on}
2021/08/10

Description
[CVE-2021-33695] Multiple Vulnerabilities in SAP Cloud Connector

Security Advisory

_{Related note}
3063048

_CVSS
4.7

_{Affected system
type}
BI/BO platform

_Patchday
2021-08

_{Released
on}
2021/08/10

Description
[CVE-2021-33697] Reverse Tabnabbing in SAP BusinessObjects Business Intelligence Platform (SAP UI5)

Security Advisory

_{Related note}
3067219

_CVSS
7.6

_{Affected system
type}
SAP Fiori Client Android

_Patchday
2021-08

_{Released
on}
2021/08/10

Description
[CVE-2021-33699] Task Hijacking in SAP Fiori Client Native Mobile for Android

Security Advisory

_{Related note}
3074844

_CVSS
8.1

_{Affected system
type}
Java

_Patchday
2021-08

_{Released
on}
2021/08/10

Description
[CVE-2021-33705] Server-Side Request Forgery (SSRF) vulnerability in SAP NetWeaver Enterprise Portal

Security Advisory

_{Related note}
3053403

_CVSS
5.4

_{Affected system
type}
SAP Lumira Server

_Patchday
2021-07

_{Released
on}
2021/07/13

Description
[CVE-2021-33682] Cross-Site Scripting (XSS) vulnerability in SAP Lumira Server

Security Advisory

_{Related note}
3066316

_CVSS
6.8

_{Affected system
type}
ABAP

_Patchday
2021-07

_{Released
on}
2021/07/13

Description
[CVE-2021-33676] Missing authorization check in SAP CRM ABAP

Security Advisory

_{Related note}
3067890

_CVSS
4.3

_{Affected system
type}
SAP 3D Visual Enterprise

_Patchday
2021-07

_{Released
on}
2021/07/13

Description
[Multiple CVEs] Improper Input Validation in SAP 3D Visual Enterprise Viewer

Security Advisory

_{Related note}
3000663

_CVSS
5.4

_{Affected system
type}
Kernel

_Patchday
2021-07

_{Released
on}
2021/07/13

Description
[CVE-2021-33683] HTTP Request Smuggling in SAP Web Dispatcher and Internet Communication Manager

Security Advisory

_{Related note}
3032624

_CVSS
5.3

_{Affected system
type}
Kernel

_Patchday
2021-07

_{Released
on}
2021/07/13

Description
[CVE-2021-33684] Memory Corruption in SAP NetWeaver AS ABAP and ABAP Platform

Security Advisory

_{Related note}
3048657

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2021-07

_{Released
on}
2021/07/13

Description
[CVE-2021-33678] Code Injection vulnerability in SAP NetWeaver AS ABAP (Reconciliation Framework)

Security Advisory

_{Related note}
3059764

_CVSS
4.5

_{Affected system
type}
Java

_Patchday
2021-07

_{Released
on}
2021/07/13

Description
[CVE-2021-33687] Information Disclosure in SAP NetWeaver AS for Java (Enterprise Portal)

Security Advisory

_{Related note}
3044751

_CVSS
4.3

_{Affected system
type}
BI/BO platform

_Patchday
2021-07

_{Released
on}
2021/07/13

Description
[CVE-2021-33667] Information Disclosure in SAP Business Objects Web Intelligence (BI Launchpad)

Security Advisory

_{Related note}
3059446

_CVSS
7.6

_{Affected system
type}
Java

_Patchday
2021-07

_{Released
on}
2021/07/13

Description
[CVE-2021-33671] Missing Authorization check in SAP NetWeaver Guided Procedures

Security Advisory

_{Related note}
3044754

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2021-07

_{Released
on}
2021/07/13

Description
[CVE-2021-33677] Information Disclosure in SAP NetWeaver AS ABAP and ABAP Platform

Security Advisory

_{Related note}
3007182

_CVSS
9.0

_{Affected system
type}
ABAP

_Patchday
2021-07

_{Released
on}
2021/06/08

Description
[CVE-2021-27610] Improper Authentication in SAP NetWeaver ABAP Server and ABAP Platform

Security Advisory

_{Related note}
3056652

_CVSS
7.5

_{Affected system
type}
Java

_Patchday
2021-07

_{Released
on}
2021/07/13

Description
[CVE-2021-33670] Denial of Service (DoS) in SAP NetWeaver AS for Java (Http Service)

Security Advisory

_{Related note}
3038594

_CVSS
3.5

_{Affected system
type}
Java

_Patchday
2021-07

_{Released
on}
2021/07/13

Description
[CVE-2021-33689] Insufficient Logging in SAP NetWeaver AS for JAVA (Administrator)

Security Advisory

_{Related note}
3028370

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2021-06

_{Released
on}
2021/06/08

Description
[CVE-2021-33665] Cross-Site Scripting (XSS) vulnerability within SAP NetWeaver AS ABAP (Applications based on SAP GUI for HTML)

Security Advisory

_{Related note}
3025604

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2021-06

_{Released
on}
2021/06/08

Description
[CVE-2021-33664] Cross-Site Scripting (XSS) vulnerability within SAP NetWeaver AS ABAP (Applications based on Web Dynpro ABAP)

Security Advisory

_{Related note}
2999590

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2021-06

_{Released
on}
2021/05/25

Description
Incomplete authorization checks for import of environmental data

Security Advisory

_{Related note}
3053066

_CVSS
8.7

_{Affected system
type}
Java

_Patchday
2021-06

_{Released
on}
2021/06/08

Description
[CVE-2021-27635] Missing XML Validation in SAP NetWeaver AS for JAVA

Security Advisory

_{Related note}
3049879

_CVSS
5.9

_{Affected system
type}
SAP Enable Now

_Patchday
2021-06

_{Released
on}
2021/06/08

Description
[CVE-2021-27637] Information Disclosure in SAP Enable Now (SAP Workforce Performance Builder - Manager)

Security Advisory

_{Related note}
3021050

_CVSS
5.9

_{Affected system
type}
Internet Graphics Service

_Patchday
2021-06

_{Released
on}
2021/06/08

Description
[Multiple CVEs] Memory Corruption vulnerability in SAP Internet Graphics Service

Security Advisory

_{Related note}
2985562

_CVSS
4.7

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2021-06

_{Released
on}
2021/06/08

Description
[CVE-2021-33666] Cross-Site Scripting (XSS) in SAP Commerce Cloud

Security Advisory

_{Related note}
3030961

_CVSS
6.4

_{Affected system
type}
Java

_Patchday
2021-06

_{Released
on}
2021/06/08

Description
[CVE-2021-27615] Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Execution

Security Advisory

_{Related note}
3030604

_CVSS
5.8

_{Affected system
type}
ABAP

_Patchday
2021-06

_{Released
on}
2021/06/08

Description
[CVE-2021-33663] Plaintext Injection in SAP NetWeaver AS for ABAP

Security Advisory

_{Related note}
2745860

_CVSS
5.3

_{Affected system
type}
Java

_Patchday
2021-05

_{Released
on}
2021/05/11

Description
Information Disclosure in Enterprise Services Repository of SAP Process Integration

Security Advisory

_{Related note}
3046610

_CVSS
8.2

_{Affected system
type}
ABAP

_Patchday
2021-05

_{Released
on}
2021/05/11

Description
[CVE-2021-27611] Code Injection vulnerability in SAP NetWeaver AS ABAP

Security Advisory

_{Related note}
3012021

_CVSS
4.9

_{Affected system
type}
Java

_Patchday
2021-05

_{Released
on}
2021/05/11

Description
[Multiple CVEs] Multiple vulnerabilities in SAP Process Integration (Integration Builder Framework)

Security Advisory

_{Related note}
2904569

_CVSS
4.6

_{Affected system
type}
SAP CRM UI

_Patchday
2021-05

_{Released
on}
2021/04/27

Description
Cross-Site Request Forgery (CSRF) vulnerability in SAP CRM WebClient UI

Security Advisory

_{Related note}
3049755

_CVSS
7.8

_{Affected system
type}
SAP Business One

_Patchday
2021-05

_{Released
on}
2021/05/11

Description
[CVE-2021-27613] Information Disclosure in SAP Business One (Chef business-one-cookbook)

Security Advisory

_{Related note}
2114798

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2021-05

_{Released
on}
2021/04/27

Description
Unauthorized use of application functions in SAP GUI for HTML

Security Advisory

_{Related note}
3023078

_CVSS
3.4

_{Affected system
type}
SAP GUI / Frontend

_Patchday
2021-05

_{Released
on}
2021/05/11

Description
[CVE-2021-27612] SAP GUI for Windows is vulnerable to redirect users to an untrusted website

Security Advisory

_{Related note}
3049661

_CVSS
7.8

_{Affected system
type}
SAP Business One

_Patchday
2021-05

_{Released
on}
2021/05/11

Description
[CVE-2021-27616] Multiple vulnerabilities in SAP Business One, version for SAP HANA (Business-One-Hana-Chef-Cookbook)

Security Advisory

_{Related note}
3039818

_CVSS
6.5

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2021-05

_{Released
on}
2021/05/11

Description
[CVE-2021-27619] Information Disclosure in SAP Commerce (Backoffice search)

Security Advisory

_{Related note}
2911863

_CVSS
5.3

_{Affected system
type}
BI/BO platform

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
Information Disclosure in BOE/CMC application

Security Advisory

_{Related note}
3025054

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27605 ] Missing Authorization check in HCM Travel Management Fiori Apps V2

Security Advisory

_{Related note}
3039649

_CVSS
7.5

_{Affected system
type}
SAP GUI / Frontend

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27608] Unquoted Search Path in SAPSetup

Security Advisory

_{Related note}
3024414

_CVSS
6.4

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27600 ] Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Execution (System Rules)

Security Advisory

_{Related note}
3040210

_CVSS
9.9

_{Affected system
type}
SAP Commerce / SAP...

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27602] Remote Code Execution vulnerability in Source Rules of SAP Commerce

Security Advisory

_{Related note}
3001824

_CVSS
7.4

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-21485] Information Disclosure in SAP NetWeaver AS for Java (Telnet Commands)

Security Advisory

_{Related note}
2963592

_CVSS
5.4

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27601] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS Java (Applications based on HTMLB for Java)

Security Advisory

_{Related note}
3030948

_CVSS
4.6

_{Affected system
type}
SAP Solution Manager...

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27609] Missing Authorization check in SAP Focused RUN

Security Advisory

_{Related note}
3036436

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27604] Potential XXE Vulnerability in SAP Process Integration (ESR Java Mappings)

Security Advisory

_{Related note}
3017908

_CVSS
8.3

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-21482] Information Disclosure in SAP NetWeaver Master Data Management

Security Advisory

_{Related note}
2818965

_CVSS
4.6

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
Clickjacking vulnerability in Runtime Workbench of SAP Process Integration

Security Advisory

_{Related note}
3005802

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2021-04

_{Released
on}
2021/03/23

Description
Cross-Site Request Forgery (CSRF) vulnerability in S/4HANA Finance for advanced payment management

Security Advisory

_{Related note}
3028729

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27603] Denial of Service (DoS) in SAP NetWeaver AS of ABAP

Security Advisory

_{Related note}
3017823

_CVSS
8.2

_{Affected system
type}
SAP Solution Manager

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-21483] Information Disclosure in SAP Solution Manager

Security Advisory

_{Related note}
3025637

_CVSS
4.3

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-21492] Content spoofing in NetWeaver AS Java HTTP Service

Security Advisory

_{Related note}
3012277

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27599] Information Disclosure in SAP Process Integration (Integration Builder Framework)

Security Advisory

_{Related note}
3036679

_CVSS
5.3

_{Affected system
type}
ABAP

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
Update 1 to Security Note 1576763: Potential information disclosure relating to usernames

Security Advisory

_{Related note}
3027937

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27598] Improper Access Control in SAP NetWeaver AS for Java (Customer Usage Provisioning Servlet)

Security Advisory

_{Related note}
3035472

_CVSS
4.3

_{Affected system
type}
SAP 3D Visual Enterprise

_Patchday
2021-04

_{Released
on}
2021/03/18

Description
[Multiple CVEs] Improper Input Validation in SAP 3D Visual Enterprise Viewer

Security Advisory

_{Related note}
3027767

_CVSS
4.3

_{Affected system
type}
SAP 3D Visual Enterprise

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
[CVE-2021-27592] Improper Input Validation in SAP 3D Visual Enterprise Viewer

Security Advisory

_{Related note}
2978151

_CVSS
4.7

_{Affected system
type}
Java

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
Reverse tabnabbing issue in Unified Rendering based frameworks in NetWeaver Application Server Java

Security Advisory

_{Related note}
3022422

_CVSS
9.6

_{Affected system
type}
Java

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
[CVE-2021-21481] Missing Authorization Check in SAP NetWeaver AS JAVA (MigrationService)

Security Advisory

_{Related note}
2983436

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
[CVE-2021-21488] Insecure deserialisation in SAP NetWeaver Knowledge Management

Security Advisory

_{Related note}
3007888

_CVSS
6.8

_{Affected system
type}
ABAP

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
[CVE-2021-21486] Missing Authorization check in SAP Enterprise Financial Services( Bank Customer Accounts )

Security Advisory

_{Related note}
3023778

_CVSS
6.8

_{Affected system
type}
ABAP

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
[CVE-2021-21487] Missing Authorization Check in Payment Engine

Security Advisory

_{Related note}
3027758

_CVSS
4.3

_{Affected system
type}
SAP 3D Visual Enterprise

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
[Multiple CVEs] Improper Input Validation in SAP 3D Visual Enterprise Viewer

Security Advisory

_{Related note}
3017378

_CVSS
7.7

_{Affected system
type}
SAP HANA Platform

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
[CVE-2021-21484] Possible authentication bypass in SAP HANA LDAP scenarios

Security Advisory

_{Related note}
3022622

_CVSS
9.9

_{Affected system
type}
Java

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
[CVE-2021-21480] Code injection vulnerability in SAP Manufacturing Integration and Intelligence

Security Advisory

_{Related note}
2977001

_CVSS
4.7

_{Affected system
type}
Java

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
Reverse TabNabbing vulnerability in SAP NetWeaver Application Server Java (Applications based on HTMLB for Java)

Security Advisory

_{Related note}
2976947

_CVSS
4.7

_{Affected system
type}
Java

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
[CVE-2021-21491] Reverse TabNabbing vulnerability in SAP NetWeaver Application Server Java (Applications based on Web Dynpro Java)

Security Advisory

_{Related note}
2475705

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2021-03

_{Released
on}
2021/02/23

Description
Switchable Authorization checks for RFC in In House Cash

Security Advisory

_{Related note}
2935791

_CVSS
5.4

_{Affected system
type}
BI/BO platform

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
[CVE-2021-21444] Clickjacking vulnerability in SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad)

Security Advisory

_{Related note}
2998173

_CVSS
6.3

_{Affected system
type}
SAP Netweaver

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
[CVE-2021-21472] Server password not set during installation of SAP NetWeaver Master Data Management 7.1

Security Advisory

_{Related note}
2974582

_CVSS
4.7

_{Affected system
type}
ABAP

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
[CVE-2021-21478] Reverse Tabnabbing vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Web Dynpro ABAP)

Security Advisory

_{Related note}
2992154

_CVSS
4.1

_{Affected system
type}
SAP HANA Platform

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
[CVE-2021-21474] SAML Assertion Signature MD5 Digest Algorithm Vulnerability in SAP HANA Database

Security Advisory

_{Related note}
2994289

_CVSS
4.1

_{Affected system
type}
ABAP

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
Reverse Tabnabbing vulnerability within SAP CRM WebClient UI

Security Advisory

_{Related note}
2835240

_CVSS
5.4

_{Affected system
type}
Java

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
Clickjacking vulnerability in Cloud Integration Content of SAP Process Integration

Security Advisory

Notifications

Security Advisories

Severity

SAP© Security advisories 179

System Types

Affected SAP© system types

Related note 3114134

CVSS 8.8

Affected system type SAP Commerce

Patchday2021-12

Released on2021/12/14

Related note 3132198

CVSS 9.8

Affected system type SAP Landscape...

Patchday2021-12

Released on2021/12/20

Related note 3132822

CVSS 9.0

Affected system type SAP HANA Platform

Patchday2021-12

Released on2021/12/21

Related note 3132744

CVSS 10.0

Affected system type SAP BTP Kyma runtime

Patchday2021-12

Released on2021/12/21

Related note 3132074

CVSS 8.0

Affected system type SAP Cloud for Customer

Patchday2021-12

Released on2021/12/23

Related note 2460948

CVSS 5.3

Affected system type ABAP

Patchday2021-12

Released on2021/11/23

Related note 3132922

CVSS 10.0

Affected system type SAP Edge Services

Patchday2021-12

Released on2021/12/21

Related note 3121165

CVSS 4.3

Affected system type SAP 3D Visual Enterprise

Patchday2021-12

Released on2021/12/14

Related note 3132162

CVSS 10.0

Affected system type SAP API Management

Patchday2021-12

Released on2021/12/24

Related note 3102769

CVSS 8.8

Affected system type Java

Patchday2021-12

Released on2021/12/14

Related note 3132964

CVSS 10.0

Affected system type SAP Enable Now

Patchday2021-12

Released on2021/12/23

Related note 3113593

CVSS 7.5

Affected system type SAP Commerce

Patchday2021-12

Released on2021/12/14

Related note 3109577

CVSS 9.9

Affected system type SAP Commerce

Patchday2021-12

Released on2021/12/14

Related note 3130521

CVSS 9.9

Affected system type Java

Patchday2021-12

Released on2021/12/16

Related note 2484231

CVSS 4.3

Affected system type ABAP

Patchday2021-12

_{Related note}
3114134

_CVSS
8.8

_{Affected system
type}
SAP Commerce

_Patchday
2021-12

_{Released
on}
2021/12/14

_{Related note}
3132198

_CVSS
9.8

_{Affected system
type}
SAP Landscape...

_Patchday
2021-12

_{Released
on}
2021/12/20

_{Related note}
3132822

_CVSS
9.0

_{Affected system
type}
SAP HANA Platform

_Patchday
2021-12

_{Released
on}
2021/12/21

_{Related note}
3132744

_CVSS
10.0

_{Affected system
type}
SAP BTP Kyma runtime

_Patchday
2021-12

_{Released
on}
2021/12/21

_{Related note}
3132074

_CVSS
8.0

_{Affected system
type}
SAP Cloud for Customer

_Patchday
2021-12

_{Released
on}
2021/12/23

_{Related note}
2460948

_CVSS
5.3

_{Affected system
type}
ABAP

_Patchday
2021-12

_{Released
on}
2021/11/23

_{Related note}
3132922

_CVSS
10.0

_{Affected system
type}
SAP Edge Services

_Patchday
2021-12

_{Released
on}
2021/12/21

_{Related note}
3121165

_CVSS
4.3

_{Affected system
type}
SAP 3D Visual Enterprise

_Patchday
2021-12

_{Released
on}
2021/12/14

_{Related note}
3132162

_CVSS
10.0

_{Affected system
type}
SAP API Management

_Patchday
2021-12

_{Released
on}
2021/12/24

_{Related note}
3102769

_CVSS
8.8

_{Affected system
type}
Java

_Patchday
2021-12

_{Released
on}
2021/12/14

_{Related note}
3132964

_CVSS
10.0

_{Affected system
type}
SAP Enable Now

_Patchday
2021-12

_{Released
on}
2021/12/23

_{Related note}
3113593

_CVSS
7.5

_{Affected system
type}
SAP Commerce

_Patchday
2021-12

_{Released
on}
2021/12/14

_{Related note}
3109577

_CVSS
9.9

_{Affected system
type}
SAP Commerce

_Patchday
2021-12

_{Released
on}
2021/12/14

_{Related note}
3130521

_CVSS
9.9

_{Affected system
type}
Java

_Patchday
2021-12

_{Released
on}
2021/12/16

_{Related note}
2484231

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2021-12

_{Released
on}
2021/12/14

_{Related note}
3103677

_CVSS
4.1

_{Affected system
type}
BI/BO platform

_Patchday
2021-12

_{Released
on}
2021/12/14