In May 2022, SAP released critical security updates addressing vulnerabilities across SAP NetWeaver, SAP BusinessObjects, SAP Business One Cloud, and Fiori UI components. These patches resolve significant risks, including remote code execution, information disclosure, and unauthorized access, requiring immediate attention from security administrators.
What were the critical SAP security updates in May 2022?
The May 2022 security release included several high-priority patches designed to harden SAP environments against exploitation:
- SAP NetWeaver Application Server ABAP (Note 3165801): Patches a critical missing authorization check. It introduces a check for object
SOCSENDto prevent the unauthorized transmission of ABAP list output via email. This affects allSAP_BASISversions from 700 to 788. - SAP Business One Cloud (Note 3170990/3189409): Provides a patch for the critical Spring4Shell Remote Code Execution vulnerability, a high-severity flaw that could allow attackers to execute arbitrary code on the server.
- SAP BusinessObjects (Note 2998510): Resolves an information disclosure vulnerability in the Central Management Server (CMS) that could lead to the leakage of authentication credentials within Sysmon event logs.
- SAP Fiori for Financial Accounting (Notes 2756188 and 2754555): Patches Cross-Site Request Forgery (CSRF) vulnerabilities affecting the front-end and back-end components of Bank Payments.
Summary of May 2022 SAP Security Notes
| SAP Note | Component | Vulnerability Type | Impact |
|---|---|---|---|
| 3165801 | SAP NetWeaver AS ABAP | Missing Authorization | Unauthorized Data Transmission |
| 3170990/3189409 | SAP Business One Cloud | Remote Code Execution | Critical (Spring4Shell) |
| 2998510 | SAP BusinessObjects | Information Disclosure | Credential Leakage |
| 2756188/2754555 | Fiori UI (Financial Acct) | CSRF | Unauthorized Action |
Frequently Asked Questions
What is the risk associated with the SAP NetWeaver note 3165801?
This note addresses a missing authorization check for the SOCSEND object. Without this patch, unauthorized users could potentially transmit the contents of ABAP list outputs via email, leading to sensitive data exposure.
Why is the update for SAP Business One Cloud considered critical?
The update includes a fix for the Spring4Shell Remote Code Execution (RCE) vulnerability. Spring4Shell is a high-severity flaw that can allow unauthenticated attackers to execute arbitrary code on the host system, making it a priority for immediate patching.
How does the vulnerability in SAP BusinessObjects affect security?
Note 2998510 patches an information disclosure flaw in the Central Management Server (CMS). Exploitation of this vulnerability could lead to authentication credentials being leaked into Sysmon event logs, providing attackers with sensitive information to further compromise the system.