SAP Security Patch Day — September 2021

Exploited 1

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

• Critical 9.9
  CVE-2021-38163 Exploited Public exploit SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can uploa…
  EPSS 37%

Critical 7

• Critical 10.0
  CVE-2021-37535 SAP NetWeaver Application Server Java (JMS Connector Service) - versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary authorization checks fo…
  EPSS 1.1%
• Critical 9.9
  CVE-2021-33690 Public exploit Scanner template Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.2…
  EPSS 69%
• Critical 9.9
  CVE-2021-33698 SAP Business One, version - 10.0, allows an attacker with business authorization to upload any files (including script files) without the proper file format va…
  EPSS 1.1%
• Critical 9.9
  CVE-2021-37531 SAP NetWeaver Knowledge Management XML Forms versions - 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, contains an XSLT vulnerability which allows a non-administrative au…
  EPSS 3.2%
• Critical 9.9
  CVE-2021-38176 Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section t…
  EPSS 1.3%
• Critical 9.6
  CVE-2021-33672 Due to missing encoding in SAP Contact Center's Communication Desktop component- version 700, an attacker could send malicious script in chat message. When the…
  EPSS 1.1%
• Critical 9.1
  CVE-2021-33701 DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 710, 2011_1_752, 2020, SAPSCOR…
  EPSS 2.1%

All vulnerabilities 33