Summary
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuführen oder Sicherheitsvorkehrungen zu umgehen.
Product
SAP stellt unternehmensweite Lösungen für Geschäftsprozesse wie Buchführung, Vertrieb, Einkauf und Lagerhaltung zur Verfügung.
Vulnerabilities 24
-
Critical 10.0
Multiple vulnerabilities in SAP Diagnostics Agent (EventLogServiceCollector)
Due to missing authentication and input sanitization of code the EventLogServiceCollector of SAP Diagnostics Agent - version 720, allows an attacker to execute malicious scripts on all connected Diagnostics Agents running on Windows. On successful exploitatio…
-
Critical 9.9CVE-2022-41272 Public exploit
An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined S…
-
Critical 9.8CVE-2023-28765 EPSS 15%
Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management )
An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, can get access to lcmbiar file and further decrypt the file. After this attacker can gain access to BI user’s passwords and dep…
-
Critical 9.6
Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker with non-administrative authorizations to exploit a directory traversal flaw in an available servic…
-
Critical 9.0CVE-2023-27267 EPSS 14%
Multiple vulnerabilities in SAP Diagnostics Agent (OSCommand Bridge)
Due to missing authentication and insufficient input validation, the OSCommand Bridge of SAP Diagnostics Agent - version 720, allows an attacker with deep knowledge of the system to execute scripts on all connected Diagnostics Agents. On successful exploitati…
-
High 8.8CVE-2020-13936 EPSS 23%
Velocity Sandbox Bypass
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/mod…
-
High 8.7CVE-2023-29186 EPSS 25%
Directory/Path Traversal vulnerability in SAP NetWeaver.
In SAP NetWeaver (BI CONT ADDON) - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to upload and overwrite files on the SAP server. Data cannot be read but if a remote attacker has sufficient (administrative) privil…
-
Medium 6.8
Information Disclosure vulnerability in SAP Landscape Management
An information disclosure vulnerability exists in SAP Landscape Management - version 3.0, enterprise edition. It allows an authenticated SAP Landscape Management user to obtain privileged access to other systems making those other systems vulnerable to inform…
-
Medium 6.7
DLL Hijacking vulnerability in SapSetup (Software Installation Program)
A Windows user with basic user authorization can exploit a DLL hijacking attack in SapSetup (Software Installation Program) - version 9.0, resulting in a privilege escalation running code as administrator of the very same Windows PC. A successful attack depen…
-
Medium 6.5
SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests) - version 600, allows an authenticated attacker to…
-
Medium 6.5
Missing Authentication check in SAP NetWeaver Enterprise Portal
In SAP NetWeaver Enterprise Portal - version 7.50, an unauthenticated attacker can attach to an open interface and make use of an open API to access a service which will enable them to access or modify server settings and data, leading to limited impact on co…
-
Medium 6.5
Denial of Service in SAP NetWeaver AS for ABAP and ABAP Platform
SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker authenticated as a non-administrative user to craft a request with certain parameters which can consume the server's resources sufficie…
-
Medium 6.1
Cross-Site Scripting (XSS) vulnerability in SAP GUI for HTML
SAP GUI for HTML - versions KERNEL 7.22, 7.53, 7.54, 7.77, 7.81, 7.85, 7.89, 7.91, KRNL64UC, 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT does not sufficiently encode user-controlled inputs, resulting in a reflected Cross-Site Scripting (XSS) vulnerability. An attac…
-
Medium 6.0
Code Injection vulnerability in SAP CRM
In SAP CRM - versions 700, 701, 702, 712, 713, an attacker who is authenticated with a non-administrative role and a common remote execution authorization can use a vulnerable interface to execute an application function to perform actions which they would no…
-
Medium 5.4
SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32U…
-
Medium 5.4
HTTP Verb Tampering vulnerability in SAP CRM (WebClient UI)
SAP CRM (WebClient UI) - versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800, 801, allows an authenticated attacker to modify HTTP verbs used in requests to the web server. This application is exposed over the network …
-
Medium 5.3
Improper Access Control in SAP NetWeaver AS Java for Deploy Service
SAP NetWeaver AS Java for Deploy Service - version 7.5, does not perform any access control checks for functionalities that require user identity enabling an unauthenticated attacker to attach to an open interface and make use of an open naming and directory …
-
Medium 5.3
Denial of Service (DOS) in SAP NetWeaver AS for ABAP (Business Server Pages)
SAP NetWeaver AS for ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an attacker authenticated as a non-administrative user to craft a request with certain parameters in certain circumstances whi…
-
Medium 5.0
IP filter vulnerability in ABAP Platform and SAP Web Dispatcher
The IP filter in ABAP Platform and SAP Web Dispatcher - versions WEBDISP 7.85, 7.89, KERNEL 7.85, 7.89, 7.91, may be vulnerable by erroneous IP netmask handling. This may enable access to backend applications from unwanted sources.
-
Medium 4.4
Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard)
The SAP Application Interface Framework (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows an Excel formula injection. An authorized attacker can inject arbitrary Excel formulas into fie…
-
Medium 4.3
Missing Authorization check in SAP HCM Fiori App My Forms (Fiori 2.0)
SAP HCM Fiori App My Forms (Fiori 2.0) - version 605, does not perform necessary authorization checks for an authenticated user exposing the restricted header data.
-
Low 3.7
Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard)
The SAP Application Interface (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 100, 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows the usage HTML tags. An authorized attacker can use some of the basic HTML codes such as heading, ba…
-
Low 3.7
Code Injection vulnerability in SAP Application Interface Framework (Message Monitoring)
The SAP Application Interface (Message Monitoring) - versions 600, 700, allows an authorized attacker to input links or headings with custom CSS classes into a comment. The comment will render links and custom CSS classes as HTML objects. After successful exp…
-
Low 3.1
Information Disclosure vulnerability in SAP Application Interface Framework (ODATA service)
The SAP AIF (ODATA service) - versions 755, 756, discloses more detailed information than is required. An authorized attacker can use the collected information possibly to exploit the component. As a result, an attacker can cause a low impact on the confident…
Revision history
-
#1
Initiale Fassung
References
-
SAP Security Patch Day April 2023 vom 2023-04-10
https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a&rc=10