SAP Security Patch Day — April 2022
Tuesday, 12 April 2022
- Vulnerabilities
- 19
- Critical
- 0
- High
- 0
- Zero-days
- 0
- Public exploit
- 1
Exploited 0
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
None of this release's vulnerabilities is known to be exploited so far.
Public exploit code 1
Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.
All vulnerabilities 19
Unscored19 ShowHide
-
Unscored
CVE-2022-28213 Public exploit When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML docume…EPSS 12%
- Unscored
- Unscored
- Unscored
- Unscored
- Unscored
- Unscored
-
Unscored
CVE-2022-27654 When a user opens a manipulated Photoshop Document (.psd, 2d.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the applica…EPSS 1.1%
-
Unscored
CVE-2022-27655 When a user opens a manipulated Universal 3D (.u3d, 3difr.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the applicatio…EPSS 1.1%
-
Unscored
CVE-2022-27657 A highly privileged remote attacker, can gain unauthorized access to display contents of restricted directories by exploiting insufficient validation of path i…EPSS 2.5%
-
Unscored
CVE-2022-27667 Under certain conditions, SAP BusinessObjects Business Intelligence platform, Client Management Console (CMC) - version 430, allows an attacker to access infor…EPSS 1.4%
-
Unscored
CVE-2022-27669 An unauthenticated user can use functions of XML Data Archiving Service of SAP NetWeaver Application Server for Java - version 7.50, to which access should be …EPSS 1%
- Unscored
-
Unscored
CVE-2022-27671 A CSRF token visible in the URL may possibly lead to information disclosure vulnerability.EPSS 1.3%
- Unscored
- Unscored
- Unscored
-
Unscored
CVE-2022-28772 By overlong input values an attacker may force overwrite of the internal program stack in SAP Web Dispatcher - versions 7.53, 7.77, 7.81, 7.85, 7.86, or Intern…EPSS 1.4%
-
Unscored
CVE-2022-28773 Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash, leading to denial of service, but can…EPSS 1.5%