SAP© Security Advisories - 09 2021 - SecurityBridge Cloud Platform

We've created the first of its kind, SecurityBridge Cloud Platform, designed to prioritize SAP patches, updates, and remediation strategies that help prevent disruptions to critical business systems. Our security advisories provide SAP users with valuable insights into the security and business implications of operating SAP.

The user interface is designed to be as intuitive as possible, but we’d love to hear your feedback and suggestions.
We hope you enjoy using it!

× Yikes, there is work to do!
This time we found critical correction advisiories. We count 19 and the highest CVSS score is 10.0.

Severity

SAP© Security advisories 19

System Types

Affected SAP© system types

_{Related note}
3082500

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-38175] Information Disclosure in SAP Analysis for Microsoft Office

Security Advisory

_{Related note}
3069032

_CVSS
6.5

_{Affected system
type}
SAP Business One

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-33685] Directory Traversal vulnerability in SAP Business One

Security Advisory

_{Related note}
2308378

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
Missing Authorization check in Financial Accounting

Security Advisory

_{Related note}
3089831

_CVSS
9.9

_{Affected system
type}
ABAP

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-38176] SQL Injection vulnerability in SAP NZDT Mapping Table Framework

Security Advisory

_{Related note}
3080567

_CVSS
8.9

_{Affected system
type}
Kernel

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-38162] HTTP Request Smuggling in SAP Web Dispatcher

Security Advisory

_{Related note}
3081888

_CVSS
9.9

_{Affected system
type}
Java

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-37531] Code Injection vulnerability in SAP NetWeaver Knowledge Management (XMLForms)

Security Advisory

_{Related note}
3078609

_CVSS
10.0

_{Affected system
type}
Java

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-37535] Missing Authorization check in SAP NetWeaver Application Server for Java (JMS Connector Service)

Security Advisory

_{Related note}
3051787

_CVSS
7.5

_{Affected system
type}
ABAP Java HANA platform

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-38177] Null Pointer Dereference vulnerability in SAP CommonCryptoLib

Security Advisory

_{Related note}
3082219

_CVSS
4.8

_{Affected system
type}
Java

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-21489] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal

Security Advisory

_{Related note}
3084487

_CVSS
9.9

_{Affected system
type}
Java

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-38163] Unrestricted File Upload vulnerability in SAP NetWeaver (Visual Composer 7.0 RT)

Security Advisory

_{Related note}
3055180

_CVSS
5.4

_{Affected system
type}
BI/BO platform

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-33679] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (BI Workspace)

Security Advisory

_{Related note}
3087791

_CVSS
4.3

_{Affected system
type}
SAP 3D Visual Enterprise

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-38174] Improper Input Validation in SAP 3D Visual Enterprise Viewer

Security Advisory

_{Related note}
3060621

_CVSS
6.1

_{Affected system
type}
SAP GUI / Frontend

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-38150] Information disclosure in SAP Business Client

Security Advisory

_{Related note}
3073891

_CVSS
9.6

_{Affected system
type}
BCM platform

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-33672] Multiple vulnerabilities in SAP Contact Center

Security Advisory

_{Related note}
3075546

_CVSS
4.3

_{Affected system
type}
SAP Business One

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-37532] Directory Listing Enabled in SAP Business One

Security Advisory

_{Related note}
3069882

_CVSS
4.3

_{Affected system
type}
SAP Business One

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-33688] SQL Injection vulnerability in SAP Business One

Security Advisory

_{Related note}
3070138

_CVSS
5.3

_{Affected system
type}
SAP Business One

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-33686] Information Disclosure in SAP Business One

Security Advisory

_{Related note}
3068337

_CVSS
3.5

_{Affected system
type}
ABAP

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
Reverse tabnabbing vulnerability in SAP Marketing Lead Nurture Stream

Security Advisory

_{Related note}
3068582

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2021-09

_{Released
on}
2021/09/14

Description
[CVE-2021-38164] Missing Authorization check in in SAP ERP Financial Accounting / RFOPENPOSTING_FR

Security Advisory

Notifications

Severity

SAP© Security advisories 19

System Types

Affected SAP© system types

Related note 3082500

CVSS 6.5

Affected system type ABAP

Patchday2021-09

Released on2021/09/14

Related note 3069032

CVSS 6.5

Affected system type SAP Business One

Patchday2021-09

Released on2021/09/14

Related note 2308378

CVSS 4.3

Affected system type ABAP

Patchday2021-09

Released on2021/09/14

Related note 3089831

CVSS 9.9

Affected system type ABAP

Patchday2021-09

Released on2021/09/14

Related note 3080567

CVSS 8.9

Affected system type Kernel

Patchday2021-09

Released on2021/09/14

Related note 3081888

CVSS 9.9

Affected system type Java

Patchday2021-09

Released on2021/09/14

Related note 3078609

CVSS 10.0

Affected system type Java

Patchday2021-09

Released on2021/09/14

Related note 3051787

CVSS 7.5

Affected system type ABAP Java HANA platform

Patchday2021-09

Released on2021/09/14

Related note 3082219

CVSS 4.8

Affected system type Java

Patchday2021-09

Released on2021/09/14

Related note 3084487

CVSS 9.9

Affected system type Java

Patchday2021-09

Released on2021/09/14

Related note 3055180

CVSS 5.4

Affected system type BI/BO platform

Patchday2021-09

Released on2021/09/14

Related note 3087791

CVSS 4.3

Affected system type SAP 3D Visual Enterprise

Patchday2021-09

Released on2021/09/14

Related note 3060621

CVSS 6.1

Affected system type SAP GUI / Frontend

Patchday2021-09

Released on2021/09/14

Related note 3073891

CVSS 9.6

Affected system type BCM platform

Patchday2021-09

Released on2021/09/14

Related note 3075546

CVSS 4.3

Affected system type SAP Business One

Patchday2021-09

Released on2021/09/14

_{Related note}
3082500

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2021-09

_{Released
on}
2021/09/14

_{Related note}
3069032

_CVSS
6.5

_{Affected system
type}
SAP Business One

_Patchday
2021-09

_{Released
on}
2021/09/14

_{Related note}
2308378

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2021-09

_{Released
on}
2021/09/14

_{Related note}
3089831

_CVSS
9.9

_{Affected system
type}
ABAP

_Patchday
2021-09

_{Released
on}
2021/09/14

_{Related note}
3080567

_CVSS
8.9

_{Affected system
type}
Kernel

_Patchday
2021-09

_{Released
on}
2021/09/14

_{Related note}
3081888

_CVSS
9.9

_{Affected system
type}
Java

_Patchday
2021-09

_{Released
on}
2021/09/14

_{Related note}
3078609

_CVSS
10.0

_{Affected system
type}
Java

_Patchday
2021-09

_{Released
on}
2021/09/14

_{Related note}
3051787

_CVSS
7.5

_{Affected system
type}
ABAP Java HANA platform

_Patchday
2021-09

_{Released
on}
2021/09/14

_{Related note}
3082219

_CVSS
4.8

_{Affected system
type}
Java

_Patchday
2021-09

_{Released
on}
2021/09/14

_{Related note}
3084487

_CVSS
9.9

_{Affected system
type}
Java

_Patchday
2021-09

_{Released
on}
2021/09/14

_{Related note}
3055180

_CVSS
5.4

_{Affected system
type}
BI/BO platform

_Patchday
2021-09

_{Released
on}
2021/09/14

_{Related note}
3087791

_CVSS
4.3

_{Affected system
type}
SAP 3D Visual Enterprise

_Patchday
2021-09

_{Released
on}
2021/09/14

_{Related note}
3060621

_CVSS
6.1

_{Affected system
type}
SAP GUI / Frontend

_Patchday
2021-09

_{Released
on}
2021/09/14

_{Related note}
3073891

_CVSS
9.6

_{Affected system
type}
BCM platform

_Patchday
2021-09

_{Released
on}
2021/09/14

_{Related note}
3075546

_CVSS
4.3

_{Affected system
type}
SAP Business One

_Patchday
2021-09

_{Released
on}
2021/09/14

_{Related note}
3069882

_CVSS
4.3

_{Affected system
type}
SAP Business One

_Patchday
2021-09

_{Released
on}
2021/09/14