SAP© Security Advisories - 04 2021 - SecurityBridge Cloud Platform

We've created the first of its kind, SecurityBridge ^{Cloud Platform} to prioritize SAP patches, updates and the remediation strategies essential for preventing the disruption of vital business systems. Our security advisories enable SAP users to understand the security and business implications of running SAP.

The user interface, is designed to be as intuitive as possible but we'd love to hear your feedback and opinions.
We hope you like it!

× Yikes, there is work to do!
This time we found critical correction advisiories. We count 19 and the highest CVSS score is 9.9.

Severity

SAP© Security advisories 19

System Types

Affected SAP© system types

_{Related note}
2911863

_CVSS
5.3

_{Affected system
type}
BI/BO platform

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
Information Disclosure in BOE/CMC application

Security Advisory

_{Related note}
3035472

_CVSS
4.3

_{Affected system
type}
SAP 3D Visual Enterprise

_Patchday
2021-04

_{Released
on}
2021/03/18

Description
[Multiple CVEs] Improper Input Validation in SAP 3D Visual Enterprise Viewer

Security Advisory

_{Related note}
3025054

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27605 ] Missing Authorization check in HCM Travel Management Fiori Apps V2

Security Advisory

_{Related note}
3027937

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27598] Improper Access Control in SAP NetWeaver AS for Java (Customer Usage Provisioning Servlet)

Security Advisory

_{Related note}
3036679

_CVSS
5.3

_{Affected system
type}
ABAP

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
Update 1 to Security Note 1576763: Potential information disclosure relating to usernames

Security Advisory

_{Related note}
3012277

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27599] Information Disclosure in SAP Process Integration (Integration Builder Framework)

Security Advisory

_{Related note}
3025637

_CVSS
4.3

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-21492] Content spoofing in NetWeaver AS Java HTTP Service

Security Advisory

_{Related note}
3017823

_CVSS
8.2

_{Affected system
type}
SAP Solution Manager

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-21483] Information Disclosure in SAP Solution Manager

Security Advisory

_{Related note}
3028729

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27603] Denial of Service (DoS) in SAP NetWeaver AS of ABAP

Security Advisory

_{Related note}
3017908

_CVSS
8.3

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-21482] Information Disclosure in SAP NetWeaver Master Data Management

Security Advisory

_{Related note}
2963592

_CVSS
5.4

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27601] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS Java (Applications based on HTMLB for Java)

Security Advisory

_{Related note}
3040210

_CVSS
9.9

_{Affected system
type}
SAP Commerce / SAP...

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27602] Remote Code Execution vulnerability in Source Rules of SAP Commerce

Security Advisory

_{Related note}
3039649

_CVSS
7.5

_{Affected system
type}
SAP GUI / Frontend

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27608] Unquoted Search Path in SAPSetup

Security Advisory

_{Related note}
3024414

_CVSS
6.4

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27600 ] Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Execution (System Rules)

Security Advisory

_{Related note}
3001824

_CVSS
7.4

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-21485] Information Disclosure in SAP NetWeaver AS for Java (Telnet Commands)

Security Advisory

_{Related note}
3005802

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2021-04

_{Released
on}
2021/03/23

Description
Cross-Site Request Forgery (CSRF) vulnerability in S/4HANA Finance for advanced payment management

Security Advisory

_{Related note}
2818965

_CVSS
4.6

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
Clickjacking vulnerability in Runtime Workbench of SAP Process Integration

Security Advisory

_{Related note}
3030948

_CVSS
4.6

_{Affected system
type}
SAP Solution Manager...

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27609] Missing Authorization check in SAP Focused RUN

Security Advisory

_{Related note}
3036436

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27604] Potential XXE Vulnerability in SAP Process Integration (ESR Java Mappings)

Security Advisory

Notifications

Severity

SAP© Security advisories 19

System Types

Affected SAP© system types

Related note 2911863

CVSS 5.3

Affected system type BI/BO platform

Patchday2021-04

Released on2021/04/13

Related note 3035472

CVSS 4.3

Affected system type SAP 3D Visual Enterprise

Patchday2021-04

Released on2021/03/18

Related note 3025054

CVSS 4.3

Affected system type ABAP

Patchday2021-04

Released on2021/04/13

Related note 3027937

CVSS 6.5

Affected system type Java

Patchday2021-04

Released on2021/04/13

Related note 3036679

CVSS 5.3

Affected system type ABAP

Patchday2021-04

Released on2021/04/13

Related note 3012277

CVSS 6.5

Affected system type Java

Patchday2021-04

Released on2021/04/13

Related note 3025637

CVSS 4.3

Affected system type Java

Patchday2021-04

Released on2021/04/13

Related note 3017823

CVSS 8.2

Affected system type SAP Solution Manager

Patchday2021-04

Released on2021/04/13

Related note 3028729

CVSS 6.5

Affected system type ABAP

Patchday2021-04

Released on2021/04/13

Related note 3017908

CVSS 8.3

Affected system type Java

Patchday2021-04

Released on2021/04/13

Related note 2963592

CVSS 5.4

Affected system type Java

Patchday2021-04

Released on2021/04/13

Related note 3040210

CVSS 9.9

Affected system type SAP Commerce / SAP...

Patchday2021-04

Released on2021/04/13

Related note 3039649

CVSS 7.5

Affected system type SAP GUI / Frontend

Patchday2021-04

Released on2021/04/13

Related note 3024414

CVSS 6.4

Affected system type Java

Patchday2021-04

Released on2021/04/13

Related note 3001824

CVSS 7.4

Affected system type Java

Patchday2021-04

Released on2021/04/13

_{Related note}
2911863

_CVSS
5.3

_{Affected system
type}
BI/BO platform

_Patchday
2021-04

_{Released
on}
2021/04/13

_{Related note}
3035472

_CVSS
4.3

_{Affected system
type}
SAP 3D Visual Enterprise

_Patchday
2021-04

_{Released
on}
2021/03/18

_{Related note}
3025054

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2021-04

_{Released
on}
2021/04/13

_{Related note}
3027937

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

_{Related note}
3036679

_CVSS
5.3

_{Affected system
type}
ABAP

_Patchday
2021-04

_{Released
on}
2021/04/13

_{Related note}
3012277

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

_{Related note}
3025637

_CVSS
4.3

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

_{Related note}
3017823

_CVSS
8.2

_{Affected system
type}
SAP Solution Manager

_Patchday
2021-04

_{Released
on}
2021/04/13

_{Related note}
3028729

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2021-04

_{Released
on}
2021/04/13

_{Related note}
3017908

_CVSS
8.3

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

_{Related note}
2963592

_CVSS
5.4

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

_{Related note}
3040210

_CVSS
9.9

_{Affected system
type}
SAP Commerce / SAP...

_Patchday
2021-04

_{Released
on}
2021/04/13

_{Related note}
3039649

_CVSS
7.5

_{Affected system
type}
SAP GUI / Frontend

_Patchday
2021-04

_{Released
on}
2021/04/13

_{Related note}
3024414

_CVSS
6.4

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

_{Related note}
3001824

_CVSS
7.4

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

_{Related note}
3005802

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2021-04

_{Released
on}
2021/03/23