In November 2021, SAP released critical security updates addressing vulnerabilities across several key platforms, including SAP NetWeaver, SAP Solution Manager, and SAP Commerce. These patches resolve high-priority risks such as SQL injection, privilege escalation, and unauthorized access, requiring immediate attention from security administrators to maintain landscape integrity.
What were the key SAP security updates in November 2021?
The November 2021 security release focused on mitigating risks associated with system access and code integrity:
- SAP NZDT Mapping Table Framework (Note 3089831): Patches a SQL injection vulnerability that could allow attackers to access backend databases or inject malicious code. Applying this fix deactivates certain function modules, rendering the SAP Test Data Migration Server unusable; a workaround using Unified Connectivity (UCON) is available.
- ABAP Platform Kernel (Note 3099776): Resolves a missing authorization check that could be exploited to escalate privileges and access connected systems via RFC or HTTP connections.
- SAP Solution Manager & Focused Run (Note 2971638): Removes hardcoded credentials for CA Introscope Enterprise Manager, requiring manual steps to update to secure credentials.
- SAP Commerce (Note 3110328): Patches a missing authorization check in the B2B Accelerator that could lead to privilege escalation.
- SAP Supply Chain Management (Note 2827086): Addresses memory corruption and denial of service vulnerabilities in SAP Forecasting and Replenishment for Retail.
How to mitigate the SQL injection risk in SAP NZDT?
The vulnerability in the SAP NZDT Mapping Table Framework (Note 3089831) is severe. The automatic correction deactivates affected function modules, which disables the SAP Test Data Migration Server. If you cannot apply the full fix immediately, you can use a workaround to block external calls to these function modules using Unified Connectivity (UCON). Note that even with the workaround, local users with sufficient privileges may still be able to call these modules.
Summary of November 2021 SAP Security Notes
| SAP Note | Component | Vulnerability Type | Impact |
|---|---|---|---|
| 3089831 | SAP NZDT Framework | SQL Injection | Backend Access |
| 3099776 | ABAP Platform Kernel | Missing Authorization | Privilege Escalation |
| 2971638 | SolMan / Focused Run | Hardcoded Credentials | System Access |
| 3110328 | SAP Commerce | Missing Authorization | Privilege Escalation |
Frequently Asked Questions
Why does the fix for note 3089831 disable the Test Data Migration Server?
The fix for the SQL injection vulnerability in the NZDT Mapping Table Framework requires deactivating specific function modules to prevent malicious code injection. Because the SAP Test Data Migration Server relies on these modules, it becomes unusable after the patch is applied.
What is the risk of the missing authorization check in the ABAP Platform Kernel?
The vulnerability patched by note 3099776 allows attackers to escalate privileges and gain unauthorized access to connected systems through RFC or HTTP connections. Installing the recommended SP Stack Kernels is necessary to enforce the required TCODE checks.
How do I address the hardcoded credentials in SAP Solution Manager?
Note 2971638 identifies hardcoded credentials for the CA Introscope Enterprise Manager. You must manually update these credentials following the steps provided in the note to prevent unauthorized access to your Solution Manager or Focused Run environment.