SAP© Security Advisories - 12 2021 - SecurityBridge Cloud Platform

We've created the first of its kind, SecurityBridge Cloud Platform, designed to prioritize SAP patches, updates, and remediation strategies that help prevent disruptions to critical business systems. Our security advisories provide SAP users with valuable insights into the security and business implications of operating SAP.

The user interface is designed to be as intuitive as possible, but we’d love to hear your feedback and suggestions.
We hope you enjoy using it!

× Yikes, there is work to do!
This time we found critical correction advisiories. We count 31 and the highest CVSS score is 10.0.

Severity

SAP© Security advisories 31

System Types

Affected SAP© system types

_{Related note}
2460948

_CVSS
5.3

_{Affected system
type}
ABAP

_Patchday
2021-12

_{Released
on}
2021/11/23

Description
Missing Authorization Check in Vehicle Management System

Security Advisory

_{Related note}
3107332

_CVSS
6.6

_{Affected system
type}
SAP Landscape Management

_Patchday
2021-12

_{Released
on}
2021/12/14

Description
Missing Authorization Check in SAP Landscape Management

Security Advisory

_{Related note}
3109577

_CVSS
9.9

_{Affected system
type}
SAP Commerce

_Patchday
2021-12

_{Released
on}
2021/12/14

Description
Code Execution vulnerability in SAP Commerce, localization for China

Security Advisory

_{Related note}
3130521

_CVSS
9.9

_{Affected system
type}
Java

_Patchday
2021-12

_{Released
on}
2021/12/16

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in Java Web Service Adapter of SAP NetWeaver Process Integration

Security Advisory

_{Related note}
2484231

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2021-12

_{Released
on}
2021/12/14

Description
Missing Authorization Check in DIMP Industry Solution (Equipment and Tools Management & Bills of Services)

Security Advisory

_{Related note}
3103677

_CVSS
4.1

_{Affected system
type}
BI/BO platform

_Patchday
2021-12

_{Released
on}
2021/12/14

Description
[CVE-2021-42061] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence platform (Web Intelligence)

Security Advisory

_{Related note}
3051005

_CVSS
3.5

_{Affected system
type}
SAP UI5

_Patchday
2021-12

_{Released
on}
2021/12/14

Description
Cross-Site Scripting (XSS) Vulnerability in SAP Fiori Launchpad

Security Advisory

_{Related note}
3080816

_CVSS
2.4

_{Affected system
type}
ABAP

_Patchday
2021-12

_{Released
on}
2021/12/14

Description
[CVE-2021-44233] Missing Authorization check in GRC Access Control

Security Advisory

_{Related note}
3119365

_CVSS
9.9

_{Affected system
type}
ABAP

_Patchday
2021-12

_{Released
on}
2021/12/14

Description
[CVE-2021-44231] Code Injection vulnerability in SAP ABAP Server & ABAP Platform (Translation Tools)

Security Advisory

_{Related note}
2661033

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2021-12

_{Released
on}
2021/11/23

Description
Missing Authorization check in RFC enabled function modules in SRM

Security Advisory

_{Related note}
3124094

_CVSS
7.7

_{Affected system
type}
ABAP

_Patchday
2021-12

_{Released
on}
2021/12/14

Description
[CVE-2021-44232] Directory Traversal vulnerability in SAF-T Framework

Security Advisory

_{Related note}
3123196

_CVSS
8.4

_{Affected system
type}
ABAP

_Patchday
2021-12

_{Released
on}
2021/12/14

Description
[CVE-2021-44235] Code Injection vulnerability in utility class for SAP NetWeaver AS ABAP

Security Advisory

_{Related note}
3131397

_CVSS
10.0

_{Affected system
type}
SAP HANA Platform

_Patchday
2021-12

_{Released
on}
2021/12/17

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in XSA Cockpit

Security Advisory

_{Related note}
3131258

_CVSS
10.0

_{Affected system
type}
SAP HANA Platform

_Patchday
2021-12

_{Released
on}
2021/12/16

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP HANA XSA

Security Advisory

_{Related note}
3133772

_CVSS
10.0

_{Affected system
type}
SAP Customer Checkout

_Patchday
2021-12

_{Released
on}
2021/12/22

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP Customer Checkout

Security Advisory

_{Related note}
3130578

_CVSS
10.0

_{Affected system
type}
SAP BTP Cloud Foundry runtime

_Patchday
2021-12

_{Released
on}
2021/12/21

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP BTP Cloud Foundry

Security Advisory

_{Related note}
3132909

_CVSS
10.0

_{Affected system
type}
SAP Edge Services

_Patchday
2021-12

_{Released
on}
2021/12/24

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP Edge Services On Premise Edition

Security Advisory

_{Related note}
3132204

_CVSS
3.1

_{Affected system
type}
Java

_Patchday
2021-12

_{Released
on}
2021/12/16

Description
Update 1 to Security Note 3130521: [CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in Java Web Service Adapter of SAP NetWeaver Process Integration

Security Advisory

_{Related note}
3132198

_CVSS
9.8

_{Affected system
type}
SAP Landscape...

_Patchday
2021-12

_{Released
on}
2021/12/20

Description
[CVE-2019-17571] Code Injection vulnerability in SAP Landscape Management

Security Advisory

_{Related note}
3132822

_CVSS
9.0

_{Affected system
type}
SAP HANA Platform

_Patchday
2021-12

_{Released
on}
2021/12/21

Description
Update 1 to Security Note 3131397 [CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in XSA Cockpit

Security Advisory

_{Related note}
3132744

_CVSS
10.0

_{Affected system
type}
SAP BTP Kyma runtime

_Patchday
2021-12

_{Released
on}
2021/12/21

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP BTP Kyma

Security Advisory

_{Related note}
3132074

_CVSS
8.0

_{Affected system
type}
SAP Cloud for Customer

_Patchday
2021-12

_{Released
on}
2021/12/23

Description
[CVE-2021-44228] Code Injection vulnerability in Cloud for Customer Lotus Notes PlugIn

Security Advisory

_{Related note}
3132922

_CVSS
10.0

_{Affected system
type}
SAP Edge Services

_Patchday
2021-12

_{Released
on}
2021/12/21

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in Internet of Things Edge Platform

Security Advisory

_{Related note}
3114134

_CVSS
8.8

_{Affected system
type}
SAP Commerce

_Patchday
2021-12

_{Released
on}
2021/12/14

Description
[CVE-2021-42064] SQL Injection vulnerability in SAP Commerce

Security Advisory

_{Related note}
3132162

_CVSS
10.0

_{Affected system
type}
SAP API Management

_Patchday
2021-12

_{Released
on}
2021/12/24

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP BTP API Management (Tenant Cloning Tool)

Security Advisory

_{Related note}
3102769

_CVSS
8.8

_{Affected system
type}
Java

_Patchday
2021-12

_{Released
on}
2021/12/14

Description
[CVE-2021-42063] Cross-Site Scripting (XSS) vulnerability in SAP Knowledge Warehouse

Security Advisory

_{Related note}
3121165

_CVSS
4.3

_{Affected system
type}
SAP 3D Visual Enterprise

_Patchday
2021-12

_{Released
on}
2021/12/14

Description
[Multiple CVEs] Improper Input Validation in SAP 3D Visual Enterprise Viewer

Security Advisory

_{Related note}
3113593

_CVSS
7.5

_{Affected system
type}
SAP Commerce

_Patchday
2021-12

_{Released
on}
2021/12/14

Description
Denial of service (DOS) in SAP Commerce

Security Advisory

_{Related note}
3132964

_CVSS
10.0

_{Affected system
type}
SAP Enable Now

_Patchday
2021-12

_{Released
on}
2021/12/23

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP Enable Now Manager

Security Advisory

_{Related note}
3131047

_CVSS
10.0

_{Affected system
type}
Any

_Patchday
2021-12

_{Released
on}
2021/12/15

Description
[CVE-2021-44228] Central Security Note for Remote Code Execution vulnerability associated with Apache Log4j 2 component

Security Advisory

_{Related note}
3131824

_CVSS
8.0

_{Affected system
type}
SAP Connected Health platform

_Patchday
2021-12

_{Released
on}
2021/12/20

Description
[CVE-2021-44228] Log4j Vulnerability in Connected Health Platform 2.0 - Fhirserver

Security Advisory

Notifications

Severity

SAP© Security advisories 31

System Types

Affected SAP© system types

Related note 2460948

CVSS 5.3

Affected system type ABAP

Patchday2021-12

Released on2021/11/23

Related note 3107332

CVSS 6.6

Affected system type SAP Landscape Management

Patchday2021-12

Released on2021/12/14

Related note 3109577

CVSS 9.9

Affected system type SAP Commerce

Patchday2021-12

Released on2021/12/14

Related note 3130521

CVSS 9.9

Affected system type Java

Patchday2021-12

Released on2021/12/16

Related note 2484231

CVSS 4.3

Affected system type ABAP

Patchday2021-12

Released on2021/12/14

Related note 3103677

CVSS 4.1

Affected system type BI/BO platform

Patchday2021-12

Released on2021/12/14

Related note 3051005

CVSS 3.5

Affected system type SAP UI5

Patchday2021-12

Released on2021/12/14

Related note 3080816

CVSS 2.4

Affected system type ABAP

Patchday2021-12

Released on2021/12/14

Related note 3119365

CVSS 9.9

Affected system type ABAP

Patchday2021-12

Released on2021/12/14

Related note 2661033

CVSS 6.3

Affected system type ABAP

Patchday2021-12

Released on2021/11/23

Related note 3124094

CVSS 7.7

Affected system type ABAP

Patchday2021-12

Released on2021/12/14

Related note 3123196

CVSS 8.4

Affected system type ABAP

Patchday2021-12

Released on2021/12/14

Related note 3131397

CVSS 10.0

Affected system type SAP HANA Platform

Patchday2021-12

Released on2021/12/17

Related note 3131258

CVSS 10.0

Affected system type SAP HANA Platform

Patchday2021-12

Released on2021/12/16

Related note 3133772

CVSS 10.0

Affected system type SAP Customer Checkout

Patchday2021-12

Released on2021/12/22

_{Related note}
2460948

_CVSS
5.3

_{Affected system
type}
ABAP

_Patchday
2021-12

_{Released
on}
2021/11/23

_{Related note}
3107332

_CVSS
6.6

_{Affected system
type}
SAP Landscape Management

_Patchday
2021-12

_{Released
on}
2021/12/14

_{Related note}
3109577

_CVSS
9.9

_{Affected system
type}
SAP Commerce

_Patchday
2021-12

_{Released
on}
2021/12/14

_{Related note}
3130521

_CVSS
9.9

_{Affected system
type}
Java

_Patchday
2021-12

_{Released
on}
2021/12/16

_{Related note}
2484231

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2021-12

_{Released
on}
2021/12/14

_{Related note}
3103677

_CVSS
4.1

_{Affected system
type}
BI/BO platform

_Patchday
2021-12

_{Released
on}
2021/12/14

_{Related note}
3051005

_CVSS
3.5

_{Affected system
type}
SAP UI5

_Patchday
2021-12

_{Released
on}
2021/12/14

_{Related note}
3080816

_CVSS
2.4

_{Affected system
type}
ABAP

_Patchday
2021-12

_{Released
on}
2021/12/14

_{Related note}
3119365

_CVSS
9.9

_{Affected system
type}
ABAP

_Patchday
2021-12

_{Released
on}
2021/12/14

_{Related note}
2661033

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2021-12

_{Released
on}
2021/11/23

_{Related note}
3124094

_CVSS
7.7

_{Affected system
type}
ABAP

_Patchday
2021-12

_{Released
on}
2021/12/14

_{Related note}
3123196

_CVSS
8.4

_{Affected system
type}
ABAP

_Patchday
2021-12

_{Released
on}
2021/12/14

_{Related note}
3131397

_CVSS
10.0

_{Affected system
type}
SAP HANA Platform

_Patchday
2021-12

_{Released
on}
2021/12/17

_{Related note}
3131258

_CVSS
10.0

_{Affected system
type}
SAP HANA Platform

_Patchday
2021-12

_{Released
on}
2021/12/16

_{Related note}
3133772

_CVSS
10.0

_{Affected system
type}
SAP Customer Checkout

_Patchday
2021-12

_{Released
on}
2021/12/22

_{Related note}
3130578

_CVSS
10.0

_{Affected system
type}
SAP BTP Cloud Foundry runtime

_Patchday
2021-12

_{Released
on}
2021/12/21