Patch days / May 2022

SAP Security Patch Day — May 2022

Tuesday, 10 May 2022

Vulnerabilities: 7
Critical: 0
High: 0
Zero-days: 0
Public exploit: 0

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

All vulnerabilities 7

Unscored7 Show

Unscored
CVE-2022-27656 The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled inputs, resulting in …
Unscored
CVE-2022-28214 During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon…
Unscored
CVE-2022-28774 Under certain conditions, the SAP Host Agent logfile shows information which would otherwise be restricted.
Unscored
CVE-2022-29610 SAP NetWeaver Application Server ABAP allows an authenticated attacker to upload malicious files and delete (theme) data, which could result in Stored Cross-Si…
Unscored
CVE-2022-29611 SAP NetWeaver Application Server for ABAP and ABAP Platform do not perform necessary authorization checks for an authenticated user, resulting in escalation of…
Unscored
CVE-2022-29613 Due to insufficient input validation, SAP Employee Self Service allows an authenticated attacker with user privileges to alter employee number. On successful e…
Unscored
CVE-2022-29616 SAP Host Agent, SAP NetWeaver and ABAP Platform allow an attacker to leverage logical errors in memory management to cause a memory corruption.