SAP Security Patch Day — April 2020
Tuesday, 14 April 2020
Exploited 0
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
None of this release's vulnerabilities is known to be exploited so far.
Critical 4
-
Critical 9.3
CVE-2020-6238 SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Valida…EPSS 1.3%
-
Critical 9.1
CVE-2020-6219 SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Reports for VS version 2010, allows an atta…EPSS 1.4%
-
Critical 9.1
CVE-2020-6225 SAP NetWeaver (Knowledge Management), versions (KMC-CM - 7.00, 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 and KMC-WPC 7.30, 7.31, 7.40, 7.50), does not sufficiently va…EPSS 1.1%
-
Critical 9.1
CVE-2020-6230 SAP OrientDB, version 3.0, allows an authenticated attacker with script execute/write permissions to inject code that can be executed by the application and le…EPSS 1.1%
All vulnerabilities 26
Critical4 ShowHide
-
Critical 9.3
CVE-2020-6238 SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Valida…EPSS 1.3%
-
Critical 9.1
CVE-2020-6219 SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Reports for VS version 2010, allows an atta…EPSS 1.4%
-
Critical 9.1
CVE-2020-6225 SAP NetWeaver (Knowledge Management), versions (KMC-CM - 7.00, 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 and KMC-WPC 7.30, 7.31, 7.40, 7.50), does not sufficiently va…EPSS 1.1%
-
Critical 9.1
CVE-2020-6230 SAP OrientDB, version 3.0, allows an authenticated attacker with script execute/write permissions to inject code that can be executed by the application and le…EPSS 1.1%
High4 ShowHide
-
High 8.6
CVE-2020-6235 SAP Solution Manager (Diagnostics Agent), version 7.2, does not perform the authentication check for the functionalities of the Collector Simulator, leading to…EPSS 1.6%
-
High 7.5
CVE-2020-6237 Under certain conditions, SAP Business Objects Business Intelligence Platform, version 4.1, 4.2, dswsbobje web application allows an attacker to access informa…EPSS 1.1%
-
High 7.2
CVE-2020-6234 SAP Host Agent, version 7.21, allows an attacker with admin privileges to use the operation framework to gain root privileges over the underlying operating sys…EPSS 3.6%
-
High 7.2
CVE-2020-6236 SAP Landscape Management, version 3.0, and SAP Adaptive Extensions, version 1.0, allows an attacker with admin_group privileges to change ownership and permiss…EPSS 1.2%
Medium18 ShowHide
- Medium 6.4
- Medium 6.1
-
Medium 6.1
CVE-2020-6215 SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, allows an attacker to redire…EPSS 1.5%
- Medium 6.1
- Medium 6.1
- Medium 6.1
- Medium 6.1
- Medium 5.4
- Medium 5.4
- Medium 5.4
- Medium 5.4
- Medium 5.3
- Medium 5.3
- Medium 5.3
- Medium 5.0
- Medium 4.7
-
Medium 4.5
CVE-2020-6224 SAP NetWeaver AS Java (HTTP Service), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker with administrator privileges to access user sensit…EPSS 1.1%
- Medium 4.3