Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um die Vertraulichkeit Integrität und die Verfügbarkeit zu gefährden.
Product
SAP stellt unternehmensweite Lösungen für Geschäftsprozesse wie Buchführung, Vertrieb, Einkauf und Lagerhaltung zur Verfügung.
Vulnerabilities 26
-
High 8.8
Due to the unrestricted scope of the RFC function module, SAP BASIS - versions 731, 740, 750, 751, 752, 753, 754, 755, …
-
High 8.8
An attacker authenticated as a non-admin user with local access to a server port assigned to the SAP Host Agent (Start …
-
High 8.5
In some SAP standard roles in SAP Business Planning and Consolidation - versions - SAP_BW 750, 751, 752, 753, 754, 755,…
-
High 8.5
SAP BusinessObjects Business Intelligence platform - versions 420, 430, allows an authenticated attacker to access sens…
-
High 8.4
SAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an authenticated admin user to upl…
-
Medium 6.5
In SAP GRC (Process Control) - versions GRCFND_A V1200, GRCFND_A V8100, GRCPINW V1100_700, GRCPINW V1100_731, GRCPINW V…
-
Medium 6.5
SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which…
-
Medium 6.5
SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which…
-
Medium 6.5
SAP Solution Manager - version 720, allows an authenticated attacker to redirect users to a malicious site due to insuf…
-
Medium 6.5
SAP S/4 HANA Map Treasury Correspondence Format Data does not perform necessary authorization check for an authenticate…
-
Medium 6.5
SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests) - version 600, allows an authenticated attacker to…
-
Medium 6.1
Due to insufficient input validation, SAP NetWeaver AS Java (HTTP Provider Service) - version 7.50, allows an unauthent…
-
Medium 6.1
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
The ABAP Keyword Documentation of SAP NetWeaver Application Server - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, for ABAP and ABAP Platform does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulner…
-
Medium 6.1
SAP Solution Manager (System Monitoring) - version 720, does not sufficiently encode user-controlled inputs, resulting …
-
Medium 6.1
An unauthenticated attacker in AP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 702, 731, 740…
-
Medium 6.1
Due to insufficient input validation, SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 7…
-
Medium 6.1
SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an…
-
Medium 6.1
SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an…
-
Medium 6.1
Due to insufficient input sanitization, SAP NetWeaver AS ABAP (BSP Framework) - versions 700, 701, 702, 731, 740, 750, …
-
Medium 6.1
Due to insufficient input sanitization, SAP NetWeaver AS ABAP (Business Server Pages) - versions 700, 701, 702, 731, 74…
-
Medium 6.1
Due to lack of proper input validation, BSP application (CRM_BSP_FRAME) - versions 700, 701, 702, 731, 740, 750, 751, 7…
-
Medium 6.1
SAP NetWeaver AS ABAP (BSP Framework) application - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756…
-
Medium 5.4
SAP Business Planning and Consolidation - versions 200, 300, allows an attacker with business authorization to upload a…
-
Medium 4.3
In SAP BusinessObjects Business Intelligence (Web Intelligence user interface) - version 430, some calls return json wi…
-
Medium 4.3
SAP CRM WebClient UI - versions WEBCUIF 748, 800, 801, S4FND 102, 103, does not sufficiently encode user-controlled inp…
-
Low 3.8
SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, does not…
Revision history
-
#1
Initiale Fassung
References
-
SAP Patchday Februar 2023 vom 2023-02-13
https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a&rc=10