Summary
Ein anonymer oder authentifizierter Angreifer kann mehrere Schwachstellen in der SAP-Software ausnutzen, um seine Privilegien zu erweitern, Cross-Site-Scripting (XSS)-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu verursachen oder vertrauliche Informationen offenzulegen.
Product
SAP stellt unternehmensweite Lösungen für Geschäftsprozesse wie Buchführung, Vertrieb, Einkauf und Lagerhaltung zur Verfügung.
Vulnerabilities 12
-
High 8.8
Security misconfiguration vulnerability in SAP NetWeaver AS Java User Management Engine
Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of the newly defined security answer. This can be leveraged by an attacker to cause profound impact on c…
-
High 7.7
Information Disclosure vulnerability in SAP BusinessObjects Web Intelligence
Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using crafted document. On successful exploitation there could be a considerable impact on confidentiality …
-
High 7.2
Directory Traversal vulnerability in SAP Asset Accounting
SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to the file API's. Thus, causing a considerable impact on confidentiality, integrity and availability …
-
Medium 6.5
Missing Authorization check in SAP Group Reporting Data Collection (Enter Package Data)
SAP Group Reporting Data Collection does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, specific data can be changed via the Enter Package Data app although the user doe…
-
Medium 6.5
Denial of service (DOS) vulnerability in SAP NetWeaver AS ABAP and ABAP Platform
The ABAP Application Server of SAP NetWeaver as well as ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. This leads to a considerable impact on availability.
-
Medium 6.1
URL Redirection vulnerability in SAP S/4HANA (Manage Catalog Items and Cross-Catalog search)
SAP S/4HANA Manage Catalog Items and Cross-Catalog searches Fiori apps allow an attacker to redirect users to a malicious site due to insufficient URL validation. As a result, it may have a slight impact on confidentiality and integrity.
-
Medium 5.3
Server-Side Request Forgery in SAP NetWeaver
SAP NetWeaver application, due to insufficient input validation, allows an attacker to send a crafted request from a vulnerable web application targeting internal systems behind firewalls that are normally inaccessible to an attacker from the external network…
-
Medium 4.8
Cross-Site Scripting (XSS) vulnerability in SAP Business Connector
The application allows a high privilege attacker to append a malicious GET query parameter to Service invocations, which are reflected in the server response. Under certain circumstances, if the parameter contains a JavaScript, the script could be processed o…
-
Medium 4.8
Cross-Site Scripting (XSS) vulnerability in SAP Business Connector
The Resource Settings page allows a high privilege attacker to load exploitable payload to be stored and reflected whenever a User visits the page. In a successful attack, some information could be obtained and/or modified. However, the attacker does not have…
-
Medium 4.3
Missing Authorization check in SAP S/4 HANA (Cash Management)
Cash Management in SAP S/4 HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, attacker can add notes in the review request with 'completed' status affecting …
-
Medium 4.3
Missing Authorization check in SAP S/4 HANA (Cash Management)
Cash Management in SAP S/4 HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, an attacker can approve or reject a bank account application affecting the inte…
-
Unscored —
Due to insufficient input validation, SAP Employee Self Service allows an authenticated attacker with user privileges t…
Revision history
-
#1
Initiale Fassung
References
-
SAP Security Patch Day – April 2024 vom 2024-04-08
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/april-2024.html