Security Advisories for SAP©

Security Advisories

We've created the first of its kind, SecurityBridge ^{Cloud Platform} to prioritize SAP patches, updates and the remediation strategies essential for preventing the disruption of vital business systems. Our security advisories enable SAP users to understand the security and business implications of running SAP.

The user interface, is designed to be as intuitive as possible but we'd love to hear your feedback and opinions.
We hope you like it!

× Yikes, there is work to do!
This time we found critical correction advisiories. We count 29 and the highest CVSS score is 10.0.

Severity

SAP© Security advisories 29

System Types

Affected SAP© system types

_{Related note}
3014121

_CVSS
9.9

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
[CVE-2021-21477] Remote Code Execution vulnerability in SAP Commerce

Security Advisory

_{Related note}
2999854

_CVSS
9.9

_{Affected system
type}
ABAP

_Patchday
2021-01

_{Released
on}
2021/01/12

Description
[CVE-2021-21466] Code Injection in SAP Business Warehouse and SAP BW/4HANA

Security Advisory

_{Related note}
2986980

_CVSS
9.9

_{Affected system
type}
ABAP

_Patchday
2021-01

_{Released
on}
2021/01/12

Description
[CVE-2021-21465] Multiple vulnerabilities in SAP Business Warehouse (Database Interface)

Security Advisory

_{Related note}
2974774

_CVSS
10.0

_{Affected system
type}
Java

_Patchday
2020-12

_{Released
on}
2020/12/08

Description
[CVE-2020-26829] Missing Authentication Check in SAP NetWeaver AS JAVA (P2P Cluster Communication)

Security Advisory

_{Related note}
2989075

_CVSS
9.6

_{Affected system
type}
BI/BO platform

_Patchday
2020-12

_{Released
on}
2020/12/08

Description
[CVE-2020-26831] Missing XML Validation in SAP BusinessObjects Business Intelligence Platform (Crystal Report)

Security Advisory

_{Related note}
2983367

_CVSS
9.1

_{Affected system
type}
ABAP

_Patchday
2020-12

_{Released
on}
2020/12/08

Description
[CVE-2020-26838] Code Injection vulnerability in SAP Business Warehouse (Master Data Management) and SAP BW4HANA

Security Advisory

_{Related note}
2985866

_CVSS
10.0

_{Affected system
type}
Java

_Patchday
2020-11

_{Released
on}
2020/11/10

Description
[Multiple CVE IDs] Missing Authentication Check in SAP Solution Manager (JAVA stack)

Security Advisory

_{Related note}
2973735

_CVSS
9.1

_{Affected system
type}
ABAP

_Patchday
2020-11

_{Released
on}
2020/11/11

Description
[CVE-2020-26808] Code Injection in SAP AS ABAP and S/4 HANA (DMIS)

Security Advisory

_{Related note}
2979062

_CVSS
9.1

_{Affected system
type}
Java

_Patchday
2020-11

_{Released
on}
2020/11/10

Description
[CVE-2020-26820] Privilege escalation in SAP NetWeaver Application Server for Java (UDDI Server)

Security Advisory

_{Related note}
2982840

_CVSS
9.8

_{Affected system
type}
SAP Data Services

_Patchday
2020-11

_{Released
on}
2020/11/10

Description
Multiple Vulnerabilities in SAP Data Services

Security Advisory

_{Related note}
2969828

_CVSS
10.0

_{Affected system
type}
Solution Manager

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6364] OS Command Injection Vulnerability in CA Introscope Enterprise Manager (Affected Products: SAP Solution Manager and SAP Focused Run)

Security Advisory

_{Related note}
2958563

_CVSS
9.1

_{Affected system
type}
ABAP

_Patchday
2020-09

_{Released
on}
2020/09/08

Description
[CVE-2020-6318] Code Injection vulnerability in SAP NetWeaver (ABAP Server) and ABAP Platform

Security Advisory

_{Related note}
2961991

_CVSS
9.6

_{Affected system
type}
SAP Marketing

_Patchday
2020-09

_{Released
on}
2020/09/08

Description
[CVE-2020-6320] Improper Access Control in SAP Marketing (Mobile Channel Servlet)

Security Advisory

_{Related note}
2928635

_CVSS
9.0

_{Affected system
type}
Java

_Patchday
2020-08

_{Released
on}
2020/08/11

Description
[CVE-2020-6284] Cross-Site Scripting (XSS) in SAP NetWeaver (Knowledge Management)

Security Advisory

_{Related note}
2934135

_CVSS
10.0

_{Affected system
type}
Java

Exploit available

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
[CVE-2020-6287] Multiple Vulnerabilities in SAP NetWeaver AS JAVA (LM Configuration Wizard)

Security Advisory

_{Related note}
2928570

_CVSS
9.8

_{Affected system
type}
Java

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
Ghostcat' Apache Tomcat AJP Vulnerability in SAP Liquidity Management for Banking

Security Advisory

_{Related note}
2918924

_CVSS
9.8

_{Affected system
type}
SAP Cloud Commerce

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
[CVE-2020-6265] Use of Hard-coded Credentials in SAP Commerce and SAP Commerce Datahub

Security Advisory

_{Related note}
2835979

_CVSS
9.9

_{Affected system
type}
ABAP

_Patchday
2020-05

_{Released
on}
2020/05/12

Description
[CVE-2020-6262] Code Injection vulnerability in Service Data Download

Security Advisory

_{Related note}
2917275

_CVSS
9.1

_{Affected system
type}
SAP Adaptive Server...

_Patchday
2020-05

_{Released
on}
2020/05/12

Description
[CVE-2020-6248] Code injection in SAP Adaptive Server Enterprise (Backup Server)

Security Advisory

_{Related note}
2917090

_CVSS
9.0

_{Affected system
type}
SAP Adaptive Server...

_Patchday
2020-05

_{Released
on}
2020/05/12

Description
[CVE-2020-6252] Information Disclosure in SAP Adaptive Server Enterprise (Cockpit)

Security Advisory

_{Related note}
2900118

_CVSS
9.1

_{Affected system
type}
SAP Orient DB

_Patchday
2020-04

_{Released
on}
2020/04/14

Description
[CVE-2020-6230] Code Injection vulnerability in SAP OrientDB 3.0

Security Advisory

_{Related note}
2896682

_CVSS
9.1

_{Affected system
type}
Java

_Patchday
2020-04

_{Released
on}
2020/04/14

Description
[CVE-2020-6225] Directory Traversal vulnerability in SAP NetWeaver (Knowledge Management)

Security Advisory

_{Related note}
2904480

_CVSS
9.3

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2020-04

_{Released
on}
2020/04/14

Description
[CVE-2020-6238] Missing XML Validation vulnerability in SAP Commerce

Security Advisory

_{Related note}
2863731

_CVSS
9.1

_{Affected system
type}
BI/BO platform

_Patchday
2020-04

_{Released
on}
2020/04/14

Description
[CVE-2020-6219] Deserialization of Untrusted Data in SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer)

Security Advisory

_{Related note}
2845377

_CVSS
9.8

_{Affected system
type}
Java

_Patchday
2020-03

_{Released
on}
2020/03/10

Description
[CVE-2020-6198] Missing Authentication check in SAP Solution Manager (Diagnostics Agent)

Security Advisory

_{Related note}
2890213

_CVSS
10.0

_{Affected system
type}
Java

Exploit available

_Patchday
2020-03

_{Released
on}
2020/03/10

Description
[CVE-2020-6207] Missing Authentication Check in SAP Solution Manager (User-Experience Monitoring)

Security Advisory

_{Related note}
2806198

_CVSS
9.1

_{Affected system
type}
Java

_Patchday
2020-03

_{Released
on}
2020/03/10

Description
[CVE-2020-6203] Path Manipulation in SAP NetWeaver UDDI Server(Services Registry)

Security Advisory

_{Related note}
2622660

_CVSS
9.8

_{Affected system
type}
SAP GUI / Frontend

_Patchday
2020-02

_{Released
on}
2018/04/10

Description
Security updates for the browser control Google Chromium delivered with SAP Business Client

Security Advisory

_{Related note}
2839864

_CVSS
9.1

_{Affected system
type}
Java

_Patchday
2019-11

_{Released
on}
2019/11/12

Description
Update 2 to Security Note 2808158: [CVE-2019-0330] OS Command Injection vulnerability in SAP Diagnostics Agent

Security Advisory

Notifications