SAP Security Patch Day — March 2020
Tuesday, 10 March 2020
Exploited 1
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
-
Critical 10.0
CVE-2020-6207 Exploited Public exploit SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resultin…EPSS 98%
Critical 2
-
Critical 9.8
CVE-2020-6198 SAP Solution Manager (Diagnostics Agent), version 720, allows unencrypted connections from unauthenticated sources. This allows an attacker to control all remo…EPSS 1.4%
-
Critical 9.1
CVE-2020-6203 SAP NetWeaver UDDI Server (Services Registry), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; allows an attacker to exploit insufficient validation of pat…EPSS 1.9%
All vulnerabilities 16
Critical3 ShowHide
-
Critical 10.0
CVE-2020-6207 Exploited Public exploit SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resultin…EPSS 98%
-
Critical 9.8
CVE-2020-6198 SAP Solution Manager (Diagnostics Agent), version 720, allows unencrypted connections from unauthenticated sources. This allows an attacker to control all remo…EPSS 1.4%
-
Critical 9.1
CVE-2020-6203 SAP NetWeaver UDDI Server (Services Registry), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; allows an attacker to exploit insufficient validation of pat…EPSS 1.9%
High3 ShowHide
-
High 7.5
CVE-2020-6196 SAP BusinessObjects Mobile (MobileBIService), version 4.2, allows an attacker to generate multiple requests, using which he can block all the threads resulting…EPSS 1.4%
-
High 7.5
CVE-2020-6208 SAP Business Objects Business Intelligence Platform (Crystal Reports), versions- 4.1, 4.2, allows an attacker with basic authorization to inject code that can …EPSS 1.1%
- High 7.2
Medium9 ShowHide
- Medium 6.1
- Medium 6.1
-
Medium 5.5
CVE-2020-6202 SAP NetWeaver Application Server Java (User Management Engine), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; does not sufficiently validate the LDAP dat…EPSS 1.1%
- Medium 5.4
- Medium 5.4
- Medium 5.4
- Medium 4.7
- Medium 4.7
- Medium 4.3