Security Advisories for SAP©

Security Advisories

We've created the first of its kind, SecurityBridge ^{Cloud Platform} to prioritize SAP patches, updates and the remediation strategies essential for preventing the disruption of vital business systems. Our security advisories enable SAP users to understand the security and business implications of running SAP.

The user interface, is designed to be as intuitive as possible but we'd love to hear your feedback and opinions.
We hope you like it!

× Yikes, there is work to do!
This time we found critical correction advisiories. We count 86 and the highest CVSS score is 10.0.

Severity

SAP© Security advisories 86

System Types

Affected SAP© system types

_{Related note}
3145702

_CVSS
5.3

_{Affected system
type}
SAP Host AgentKernel

_Patchday
2022-05

_{Released
on}
2022/05/10

Description
[CVE-2022-29616] Memory Corruption vulnerability in SAP Host Agent, SAP NetWeaver and ABAP Platform

Security Advisory

_{Related note}
3145046

_CVSS
8.3

_{Affected system
type}
Kernel

_Patchday
2022-05

_{Released
on}
2022/05/10

Description
[CVE-2022-27656] Cross-Site Scripting (XSS) vulnerability in administration UI of SAP Webdispatcher and SAP Netweaver AS for ABAP and Java (ICM)

Security Advisory

_{Related note}
2998510

_CVSS
7.8

_{Affected system
type}
BI/BO platform

_Patchday
2022-05

_{Released
on}
2022/05/10

Description
[CVE-2022-28214] Central Management Server Information Disclosure in Business Intelligence Update

Security Advisory

_{Related note}
3165801

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2022-05

_{Released
on}
2022/05/10

Description
[CVE-2022-29611] Missing Authorization check in SAP NetWeaver Application Server for ABAP and ABAP Platform

Security Advisory

_{Related note}
3143161

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2022-05

_{Released
on}
2022/05/10

Description
Missing Authorization check for UI5 flexibility key user functionality

Security Advisory

_{Related note}
2756188

_CVSS
6.3

_{Affected system
type}
UI5

_Patchday
2022-05

_{Released
on}
2022/05/10

Description
Cross-Site Request Forgery (CSRF) vulnerability in F0673 Approve Bank Payments front-end

Security Advisory

_{Related note}
3189409

_CVSS
9.8

_{Affected system
type}
SAP Business One Cloud

_Patchday
2022-05

_{Released
on}
2022/05/10

Description
[CVE-2022-22965] Remote Code Execution vulnerability associated with Spring Framework used in in SAP Business One Cloud

Security Advisory

_{Related note}
3164677

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2022-05

_{Released
on}
2022/05/10

Description
[CVE-2022-29613] Information Disclosure vulnerability in SAP Employee Self Service(Fiori My Leave Request)

Security Advisory

_{Related note}
3158188

_CVSS
5.3

_{Affected system
type}
SAP Host Agent

_Patchday
2022-05

_{Released
on}
2022/05/10

Description
[CVE-2022-28774] Information Disclosure vulnerability in SAP Host Agent logfile

Security Advisory

_{Related note}
2754555

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2022-05

_{Released
on}
2022/05/10

Description
Cross-Site Request Forgery (CSRF) vulnerability in F0673 Approve Bank Payments back-end

Security Advisory

_{Related note}
3146336

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2022-05

_{Released
on}
2022/05/10

Description
[CVE-2022-29610] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP

Security Advisory

_{Related note}
3111311

_CVSS
7.5

_{Affected system
type}
Kernel

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-28772]Denial of service (DOS) in SAP Web Dispatcher and SAP Netweaver (Internet Communication Manager)

Security Advisory

_{Related note}
3132633

_CVSS
5.4

_{Affected system
type}
SAP GUI / Frontend

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
Information Disclosure vulnerability in SAP GUI for Windows

Security Advisory

_{Related note}
3145769

_CVSS
5.3

_{Affected system
type}
BI/BO platform

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-27667] Information Disclosure vulnerability in CMC

Security Advisory

_{Related note}
3111293

_CVSS
4.9

_{Affected system
type}
Kernel

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-28773] Denial of service (DOS) in SAP Web Dispatcher and SAP Netweaver (Internet Communication Manager)

Security Advisory

_{Related note}
3165333

_CVSS
4.7

_{Affected system
type}
ABAP

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-28215] URL Redirection vulnerability in SAP NetWeaver ABAP Server and ABAP Platform

Security Advisory

_{Related note}
3171258

_CVSS
9.8

_{Affected system
type}
SAP Commerce

_Patchday
2022-04

_{Released
on}
2022/04/18

Description
[CVE-2022-22965] Remote Code Execution vulnerability associated with Spring Framework used in SAP Commerce

Security Advisory

_{Related note}
3148377

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-28217] Missing XML Validation vulnerability in SAP NW EP WPC

Security Advisory

_{Related note}
3163703

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
Multiple Vulnerabilities in URI.js bundled with SAPUI5

Security Advisory

_{Related note}
3189635

_CVSS
9.8

_{Affected system
type}
SAP Customer...

_Patchday
2022-04

_{Released
on}
2022/04/14

Description
[CVE-2022-22965] Remote Code Execution vulnerability associated with Spring Framework used in SAP Customer Profitability Analytics

Security Advisory

_{Related note}
3159091

_CVSS
2.7

_{Affected system
type}
SAP Solution Manager...

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-27657] Directory Traversal vulnerability in SAP Focused Run (Simple Diagnostics Agent 1.0)

Security Advisory

_{Related note}
3152442

_CVSS
5.3

_{Affected system
type}
Java

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-27669] Missing Authentication check in XML Data Archiving Service

Security Advisory

_{Related note}
3189429

_CVSS
9.8

_{Affected system
type}
Java

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-22965] Remote Code Execution vulnerability associated with Spring Framework used in PowerDesigner Web (up to including 16.7 SP05 PL01)

Security Advisory

_{Related note}
3155609

_CVSS
7.0

_{Affected system
type}
SAP Commerce

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
Privilege escalation vulnerability in Apache Tomcat server component of SAP Commerce

Security Advisory

_{Related note}
3101986

_CVSS
4.1

_{Affected system
type}
ABAP

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
Enable CSP support for OP1909 in SAP CRM WebClient UI

Security Advisory

_{Related note}
3165856

_CVSS
4.3

_{Affected system
type}
SAP Innovation Management

_Patchday
2022-04

_{Released
on}
2022/03/28

Description
[CVE-2022-27658] Missing authorization check in SAP Innovation Management

Security Advisory

_{Related note}
3158613

_CVSS
9.1

_{Affected system
type}
Java

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
Update 1 to Security Note 3022622 - [CVE-2021-21480] Code injection vulnerability in SAP Manufacturing Integration and Intelligence

Security Advisory

_{Related note}
3170990

_CVSS
9.8

_{Affected system
type}
Any

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-22965] Central Security Note for Remote Code Execution vulnerability associated with Spring Framework

Security Advisory

_{Related note}
3126557

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-28770] Cross-Site Scripting (XSS) vulnerability in SAPUI5 (vbm library)

Security Advisory

_{Related note}
3187290

_CVSS
9.8

_{Affected system
type}
SAP Customer Checkout

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-22965] Remote Code Execution vulnerability associated with Spring Framework used in SAP Customer Checkout

Security Advisory

_{Related note}
3055044

_CVSS
5.4

_{Affected system
type}
BI/BO platform

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-28213] Missing XML Validation vulnerability in SAP BusinessObjects Business Intelligence Platform (dswsbobje - SOAP Web services)

Security Advisory

_{Related note}
3137191

_CVSS
6.8

_{Affected system
type}
BI/BO platform

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-22541] Information Disclosure vulnerability in SAP BusinessObjects Platform

Security Advisory

_{Related note}
3163583

_CVSS
6.1

_{Affected system
type}
Java

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-26105] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal

Security Advisory

_{Related note}
3130497

_CVSS
8.2

_{Affected system
type}
BI/BO platform

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-27671] CSRF token visible in one of the URL in SAP Business Intelligence Platform.

Security Advisory

_{Related note}
3148094

_CVSS
6.5

_{Affected system
type}
Sybase

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-27670] Denial of service (DOS) in SQL Anywhere

Security Advisory

_{Related note}
3143437

_CVSS
6.5

_{Affected system
type}
SAP 3D Visual Enterprise

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[Multiple CVEs] Improper Input Validation in SAP 3D Visual Enterprise Viewer

Security Advisory

_{Related note}
3189428

_CVSS
9.8

_{Affected system
type}
SAP HANA Platform

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-22965] Remote Code Execution vulnerability associated with Spring Framework used in SAP HANA Extended Application Services

Security Advisory

_{Related note}
3150845

_CVSS
4.3

_{Affected system
type}
BI/BO platform

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2022-28216] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (BI Workspace)

Security Advisory

_{Related note}
3138299

_CVSS
4.1

_{Affected system
type}
Adobe LiveCycle Designer

_Patchday
2022-04

_{Released
on}
2022/04/12

Description
[CVE-2021-44832] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP NetWeaver ABAP Server and ABAP Platform (Adobe LiveCycle Designer 11.0)

Security Advisory

_{Related note}
3145987

_CVSS
9.3

_{Affected system
type}
SAP Solution Manager...

_Patchday
2022-03

_{Released
on}
2022/03/08

Description
[CVE-2022-24396] Missing Authentication check in SAP Focused Run (Simple Diagnostics Agent 1.0)

Security Advisory

_{Related note}
3104349

_CVSS
3.3

_{Affected system
type}
ABAP

_Patchday
2022-03

_{Released
on}
2022/03/22

Description
Missing authorization check in S/4HANA finance for advanced payment management

Security Advisory

_{Related note}
3132360

_CVSS
3.7

_{Affected system
type}
Java

_Patchday
2022-03

_{Released
on}
2022/03/08

Description
[CVE-2022-26103] Information Disclosure vulnerability in SAP NetWeaver(Real Time Messaging Framework)

Security Advisory

_{Related note}
3147283

_CVSS
5.4

_{Affected system
type}
SAP Solution Manager...

_Patchday
2022-03

_{Released
on}
2022/03/08

Description
[CVE-2022-24399] Cross-Site Scripting (XSS) vulnerability in SAP Focused Run (Real User Monitoring)

Security Advisory

_{Related note}
3111110

_CVSS
4.8

_{Affected system
type}
SAPCAR

_Patchday
2022-03

_{Released
on}
2022/03/08

Description
[CVE-2022-26100] Denial of service (DOS) in SAPCAR

Security Advisory

_{Related note}
3147102

_CVSS
5.3

_{Affected system
type}
SAP Solution Manager...

_Patchday
2022-03

_{Released
on}
2022/03/08

Description
[CVE-2022-22547] Information Disclosure vulnerability in SAP Focused Run (Simple Diagnostics Agent 1.0)

Security Advisory

_{Related note}
3103424

_CVSS
5.0

_{Affected system
type}
BI/BO platform

_Patchday
2022-03

_{Released
on}
2022/03/08

Description
[CVE-2022-24398] Information Disclosure vulnerability in SAP Business Objects Business Intelligence Platform

Security Advisory

_{Related note}
3145997

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2022-03

_{Released
on}
2022/03/08

Description
[CVE-2022-26102] Missing authorization check in SAP NetWeaver Application Server for ABAP

Security Advisory

_{Related note}
3154684

_CVSS
10.0

_{Affected system
type}
SAP Work Manager

_Patchday
2022-03

_{Released
on}
2022/03/08

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP Work Manager

Security Advisory

_{Related note}
3149805

_CVSS
8.1

_{Affected system
type}
ABAP

_Patchday
2022-03

_{Released
on}
2022/03/08

Description
[CVE-2022-26101] Cross-Site Scripting (XSS) vulnerability in SAP Fiori launchpad

Security Advisory

_{Related note}
3146261

_CVSS
6.1

_{Affected system
type}
Java

_Patchday
2022-03

_{Released
on}
2022/03/08

Description
[CVE-2022-24395] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal

Security Advisory

_{Related note}
1753378

_CVSS
5.3

_{Affected system
type}
Java

_Patchday
2022-03

_{Released
on}
2013/08/13

Description
Directory traversal in Web Container

Security Advisory

_{Related note}
3146260

_CVSS
6.1

_{Affected system
type}
Java

_Patchday
2022-03

_{Released
on}
2022/03/08

Description
[CVE-2022-24397] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal

Security Advisory

_{Related note}
3144941

_CVSS
5.4

_{Affected system
type}
SAP Financial Consolidation

_Patchday
2022-03

_{Released
on}
2022/03/08

Description
[CVE-2022-26104] Missing Authorization check in SAP Financial Consolidation

Security Advisory

_{Related note}
3140564

_CVSS
5.6

_{Affected system
type}
SAP Adaptive Server...

_Patchday
2022-02

_{Released
on}
2022/02/08

Description
[CVE-2022-22528] Information Disclosure in SAP Adaptive Server Enterprise

Security Advisory

_{Related note}
3126748

_CVSS
5.4

_{Affected system
type}
BI/BO platform

_Patchday
2022-02

_{Released
on}
2022/02/08

Description
[CVE-2022-22546] XSS vulnerability in SAP Business Objects Web Intelligence (BI Launchpad)

Security Advisory

_{Related note}
3123427

_CVSS
8.1

_{Affected system
type}
Kernel

_Patchday
2022-02

_{Released
on}
2022/02/08

Description
[CVE-2022-22532] HTTP Request Smuggling in SAP NetWeaver Application Server Java

Security Advisory

_{Related note}
3140587

_CVSS
7.1

_{Affected system
type}
ABAP

_Patchday
2022-02

_{Released
on}
2022/02/08

Description
[CVE-2022-22540] SQL Injection vulnerability in SAP NetWeaver AS ABAP (Workplace Server)

Security Advisory

_{Related note}
3140940

_CVSS
9.1

_{Affected system
type}
Java

_Patchday
2022-02

_{Released
on}
2022/02/08

Description
[CVE-2022-22544] Missing segregation of duties in SAP Solution Manager Diagnostics Root Cause Analysis Tools

Security Advisory

_{Related note}
3128473

_CVSS
4.9

_{Affected system
type}
ABAP

_Patchday
2022-02

_{Released
on}
2022/02/08

Description
[CVE-2022-22545] Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform

Security Advisory

_{Related note}
3116223

_CVSS
3.7

_{Affected system
type}
Kernel

_Patchday
2022-02

_{Released
on}
2022/02/08

Description
[CVE-2022-22543] Denial of service (DOS) in SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel)

Security Advisory

_{Related note}
3142092

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2022-02

_{Released
on}
2022/02/08

Description
[CVE-2022-22542] Information Disclosure vulnerability in SAP S/4HANA (Supplier Factsheet and Enterprise Search for Business Partner, Supplier and Customer)

Security Advisory

_{Related note}
3139893

_CVSS
10.0

_{Affected system
type}
None

_Patchday
2022-02

_{Released
on}
2022/02/08

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP Dynamic Authorization Management

Security Advisory

_{Related note}
3123396

_CVSS
10.0

_{Affected system
type}
Kernel

_Patchday
2022-02

_{Released
on}
2022/02/08

Description
[CVE-2022-22536] Request smuggling and request concatenation in SAP NetWeaver, SAP Content Server and SAP Web Dispatcher

Security Advisory

_{Related note}
3124994

_CVSS
4.7

_{Affected system
type}
ABAP

_Patchday
2022-02

_{Released
on}
2022/02/08

Description
[CVE-2022-22534] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver

Security Advisory

_{Related note}
2531036

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2022-02

_{Released
on}
2019/04/09

Description
Switchable Authorization checks for RFC BCA_DIM_RESET_TRIGGER_TABLE in Loans (FI-CAX-FS)

Security Advisory

_{Related note}
3130920

_CVSS
10.0

_{Affected system
type}
SAP Data Intelligence

_Patchday
2022-02

_{Released
on}
2022/01/18

Description
Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP Data Intelligence 3 (on-premise)

Security Advisory

_{Related note}
3126489

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2022-02

_{Released
on}
2022/02/08

Description
[CVE-2022-22535] Missing Authorization check in SAP ERP HCM

Security Advisory

_{Related note}
3142773

_CVSS
10.0

_{Affected system
type}
SAP Commerce

_Patchday
2022-02

_{Released
on}
2022/02/08

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP Commerce

Security Advisory

_{Related note}
3134684

_CVSS
4.3

_{Affected system
type}
SAP 3D Visual Enterprise

_Patchday
2022-02

_{Released
on}
2022/02/08

Description
[Multiple CVEs] Improper Input Validation in SAP 3D Visual Enterprise Viewer

Security Advisory

_{Related note}
3107196

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2022-02

_{Released
on}
2022/01/25

Description
Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver AS ABAP within Web Dynpro ABAP

Security Advisory

_{Related note}
3133005

_CVSS
5.3

_{Affected system
type}
Java

_Patchday
2022-01

_{Released
on}
2021/12/28

Description
Update 2 to Security Note 3130521: [CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in Java Web Service Adapter of SAP NetWeaver Process Integration

Security Advisory

_{Related note}
3101299

_CVSS
6.6

_{Affected system
type}
SAP Business One

_Patchday
2022-01

_{Released
on}
2021/12/14

Description
[CVE-2021-42066] Information Disclosure vulnerability in SAP Business One

Security Advisory

_{Related note}
3106528

_CVSS
6.5

_{Affected system
type}
SAP Business One

_Patchday
2022-01

_{Released
on}
2022/01/11

Description
[CVE-2021-44234] Information Disclosure vulnerability in SAP Business One

Security Advisory

_{Related note}
3124597

_CVSS
6.1

_{Affected system
type}
SAP Enterprise Threat...

_Patchday
2022-01

_{Released
on}
2022/01/11

Description
[CVE-2022-22529] Cross-Site Scripting (XSS) vulnerability in SAP Enterprise Threat Detection

Security Advisory

_{Related note}
3132515

_CVSS
10.0

_{Affected system
type}
SAP Edge Services

_Patchday
2022-01

_{Released
on}
2021/12/30

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP Edge Services Cloud Edition

Security Advisory

_{Related note}
3132177

_CVSS
10.0

_{Affected system
type}
SAP Localization Hub

_Patchday
2022-01

_{Released
on}
2021/12/22

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP Localization Hub, digital compliance service for India

Security Advisory

_{Related note}
3132058

_CVSS
10.0

_{Affected system
type}
SAP IoT

_Patchday
2022-01

_{Released
on}
2022/01/11

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP Cloud-to-Cloud Interoperability

Security Advisory

_{Related note}
3134139

_CVSS
10.0

_{Affected system
type}
SAP Enterprise...

_Patchday
2022-01

_{Released
on}
2022/01/11

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j2 component used in SAP Enterprise Continuous Testing by Tricentis

Security Advisory

_{Related note}
3136094

_CVSS
10.0

_{Affected system
type}
SAP Digital...

_Patchday
2022-01

_{Released
on}
2022/01/11

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP Digital Manufacturing Cloud for Edge Computing

Security Advisory

_{Related note}
3131691

_CVSS
5.5

_{Affected system
type}
Adobe LiveCycle Designer

_Patchday
2022-01

_{Released
on}
2021/12/30

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP NetWeaver ABAP Server and ABAP Platform (Adobe LiveCycle Designer 11.0)

Security Advisory

_{Related note}
3135581

_CVSS
6.6

_{Affected system
type}
Java

_Patchday
2022-01

_{Released
on}
2022/01/11

Description
Update 3 to Security Note 3130521: [CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in Java Web Service Adapter of SAP NetWeaver Process Integration

Security Advisory

_{Related note}
3134531

_CVSS
7.5

_{Affected system
type}
SAP HANA Platform

_Patchday
2022-01

_{Released
on}
2021/12/24

Description
[CVE-2021-44228] Denial of Service vulnerability associated with Apache Log4j component used in XSA Cockpit

Security Advisory

_{Related note}
3131740

_CVSS
9.8

_{Affected system
type}
SAP Business One

_Patchday
2022-01

_{Released
on}
2022/01/11

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP Business One

Security Advisory

_{Related note}
3136988

_CVSS
10.0

_{Affected system
type}
SAP IoT

_Patchday
2022-01

_{Released
on}
2022/01/11

Description
[CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in Reference Template for enabling ingestion and persistence of time series data in Azure

Security Advisory

_{Related note}
3112928

_CVSS
8.7

_{Affected system
type}
ABAP

_Patchday
2022-01

_{Released
on}
2022/01/11

Description
[CVE-2022-22531] Multiple vulnerabilities in F0743 Create Single Payment application of SAP S/4HANA

Security Advisory

_{Related note}
3112710

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2022-01

_{Released
on}
2022/01/11

Description
[CVE-2021-42067] Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

Security Advisory

Notifications