SAP Security Notes: May 2020 Vulnerability Overview
The May 2020 SAP Security Notes address critical vulnerabilities, including code injection in Service Data Download, authentication bypass in SAP Business Intelligence Platform, and security flaws in SAP Adaptive Server Enterprise. These patches are essential for preventing server compromise and protecting sensitive system data across SAP environments. Executive Summary The May 2020 release from SAP […]
SAP Security Notes: April 2020 Vulnerability Summary
The April 2020 SAP security updates address several critical and high-risk vulnerabilities across the SAP ecosystem, including flaws in Business Objects, SAP Commerce, SAP Host Agent, and Knowledge Management. Administrators should prioritize applying these patches to prevent malicious code execution, unauthorized access, and potential privilege escalation. Executive Summary In April 2020, SAP released a series […]
SAP Security Notes: March 2020 Overview
This post summarizes the critical security vulnerabilities addressed in the March 2020 SAP Security Patch Day. It details three primary “Hot News” and critical notes affecting the SAP Diagnostics Agent, User-Experience Monitoring (UXMon), and the SAP NetWeaver UDDI Server, providing insights into their impacts and necessary remediation. Executive Summary The March 2020 SAP Security Patch […]
SAP Security Notes: February 2020 Vulnerabilities and Mitigation
The February 2020 SAP security notes address a high-risk Denial of Service (DoS) vulnerability in the SAP Host Agent and missing input validation vulnerabilities in SAP Landscape Management. These patches require specific configuration changes, including blocking untrusted network access and enabling internal operation checks to secure SAP environments against potential exploits. Executive Summary The February […]
SAP Security Notes, January 2020: Critical Vulnerability Patches
In January 2020, SAP released critical security notes addressing vulnerabilities in the Business Object Repository (BOR), clickjacking protections for SAP AS ABAP, and a Denial of Service (DOS) flaw in the Internet Communication Manager (ICM). Organizations are advised to review these patches to secure their SAP environments against unauthorized access and system instability. Executive Summary […]
SAP Security Notes: December 2019 Vulnerability Summary
The December 2019 SAP security update addressed critical vulnerabilities across three core components: SAP Enterprise Asset Management (EAM), SAP Cash Management, and SAP Central Payments. These security notes—2871877, 2734675, and 2730227—primarily resolved missing authorization checks and directory traversal flaws that could lead to privilege escalation or unauthorized file access. In December 2019, SAP released patches […]
SAP Security Notes, November 2019
Hot News Note 2839864 updates Note 2808158 for a high risk OS Command Injection vulnerability in the SAP Diagnostics Agent. The vulnerability exists within the OS Command Plugin of the Agent, accessible through transaction GPA_ADMIN and the OS Command Console. Note 2839864 provides a patch for the LM_SERVICE for Support Pack levels 6-9 of the […]
SAP Security Notes, October 2019
Hot News Note 2828682 patches a vulnerability in SAP Landscape Management Enterprise that could lead to the disclosure of critical information. Although the notes carries a CVSS score of 9.1/10, the vulnerability addressed by the note can only be executed under specific, uncommon conditions. In addition to implementing SAP Landscape Management 3.0 SP12 Patch 02, […]
SAP Security Notes, September 2019
Hot News Note 2798336 patches a critical code injection vulnerability in NetWeaver Application Server for Java (AS Java). A program error in the Web Container of AS Java could enable attackers to bypass input validation and execute dynamic content such as malicious code. The note includes updates for the J2EE Engine and API components. Note […]
SAP Security Notes, August 2019
Hot News Note 2800779 patches a remote code execution vulnerability in the SAP NetWeaver UDDI Server. The vulnerability carries a CVSS score of 9.9/10 and could be exploited to take complete control of the Services Registry, including viewing, changing, or deleting data by injecting code into the working memory which is subsequently executed by the […]