In August 2022, SAP released several critical security updates addressing vulnerabilities across SAP Knowledge Warehouse, SAP NetWeaver, and the SAP BusinessObjects (BOBJ) Business Intelligence Platform. These updates include critical patches for cross-site scripting (XSS) and various information disclosure vulnerabilities that could allow unauthorized access to sensitive system data.
What were the key SAP security updates in August 2022?
The August 2022 security release focused on mitigating risks related to unauthorized access and information exposure. Key updates included:
- SAP Knowledge Warehouse: Note 3102769 was rereleased with updated solutions, while note 3221696 was introduced to provide a workaround for deactivating the SAP IKS component to address a high-priority XSS vulnerability.
- SAP NetWeaver Application Server ABAP: Note 3150454 was updated to enforce stricter authorization checks when modifying RFC destinations via transaction SM59.
- SAP BusinessObjects (BOBJ): Note 3210823 addresses a critical information disclosure vulnerability in the Open Document web application, affecting versions 4.2 SP009 and 4.3 SP002–SP003. Additionally, notes 3213524 and 3213507 patch lower-priority information disclosure risks in the commentary and monitoring databases.
Which vulnerabilities were addressed in SAP BusinessObjects?
SAP BusinessObjects (BOBJ) received multiple patches to prevent information disclosure. The most significant is note 3210823, which resolves a vulnerability in the Open Document web application—a tool that processes URL requests for documents. Unauthenticated attackers could exploit this to retrieve sensitive information over the network. Furthermore, notes 3213524 and 3213507 address vulnerabilities in the BOBJ commentary and monitoring databases that could expose sensitive system data to attackers with network access.
Summary of August 2022 SAP Security Notes
| SAP Note | Component | Vulnerability Type | Impact |
|---|---|---|---|
| 3102769 / 3221696 | SAP Knowledge Warehouse | Cross-Site Scripting (XSS) | High Priority |
| 3150454 | SAP NetWeaver AS ABAP | Authorization Bypass | RFC Destination Security |
| 3210823 | SAP BOBJ Open Document | Information Disclosure | Sensitive Data Exposure |
| 3213524 / 3213507 | SAP BOBJ Databases | Information Disclosure | Sensitive System Data |
Frequently Asked Questions
What is the risk associated with the SAP Knowledge Warehouse vulnerability?
The vulnerability in the SAP Knowledge Warehouse is a high-priority cross-site scripting (XSS) issue. SAP provided a workaround in note 3221696, which involves deactivating the SAP IKS component to prevent potential exploitation.
How does the update to note 3150454 affect SAP NetWeaver?
The update to note 3150454 enforces stricter authorization checks in lower Service Pack (SP) levels of SAP NetWeaver Application Server ABAP. This specifically targets security when RFC destinations are modified using transaction SM59, preventing unauthorized changes.
What should BOBJ administrators prioritize?
Administrators should prioritize note 3210823, which patches a critical information disclosure vulnerability in the Open Document web application. This vulnerability allows unauthenticated attackers to retrieve sensitive information, making it a high-priority fix for affected versions (4.2 SP009 and 4.3 SP002 – SP003).