The December 2019 SAP security update addressed critical vulnerabilities across three core components: SAP Enterprise Asset Management (EAM), SAP Cash Management, and SAP Central Payments. These security notes—2871877, 2734675, and 2730227—primarily resolved missing authorization checks and directory traversal flaws that could lead to privilege escalation or unauthorized file access.
In December 2019, SAP released patches to secure its enterprise software ecosystem against emerging threats. The most significant update, Note 2871877, targeted the Maintenance, Repair, and Overhaul (MRO) Workbenches within SAP Enterprise Asset Management (EAM), mitigating risks associated with missing authorization checks and directory traversal. Additional patches addressed authorization gaps in SAP Cash Management, specifically impacting bank account management data replication between SAP S/4HANA Finance systems, and SAP Central Payments, which manages centralized clearing activities. Security teams are advised to review these notes to ensure proper implementation of the provided transport and configuration corrections.
Key Takeaways
- Note 2871877 patches privilege escalation and directory traversal vulnerabilities in SAP Enterprise Asset Management (EAM) MRO Workbenches.
- Note 2734675 addresses missing authorization checks in SAP Cash Management function modules used for bank account data replication.
- Note 2730227 secures the historical data processing component of SAP Central Payments by resolving authorization check issues.
- Administrators should apply these patches using the transport and manual corrections provided in the respective SAP Security Notes.
What vulnerabilities were patched in SAP Note 2871877?
Note 2871877 addresses multiple high-priority vulnerabilities within the Maintenance, Repair, and Overhaul (MRO) Workbenches of SAP Enterprise Asset Management (EAM). The update resolves missing authorization checks for authenticated users, which could lead to an escalation of privileges, and fixes a directory traversal vulnerability caused by insufficient path validation. The latter could enable attackers to read, overwrite, delete, or corrupt files on affected servers. Corrections are delivered via a transport included in the Note.
How does SAP Note 2734675 impact SAP Cash Management?
Note 2734675 introduces automated and manual corrections to resolve missing authorization checks in SAP Cash Management. These corrections specifically secure function modules used for the replication of Bank Account Management (BAM) master data between SAP S/4HANA Finance systems, including BAPIFCLMBAMAMDBNKANT and BAPIHOUSEBANK_REPLICATE.
What security changes were made to SAP Central Payments?
Note 2730227 addresses missing authorization checks within the historical data processing component of SAP Central Payments. This component is part of the broader SAP Central Finance solution, which supports centralized payments and clearing activities. This note specifically removes authorization gaps that were previously introduced in Note 2651431.
Summary of December 2019 SAP Security Notes
The following table summarizes the primary SAP components and issues addressed in the December 2019 security release.
| Note ID | SAP Component | Primary Issue |
|---|---|---|
| 2871877 | SAP Enterprise Asset Management (EAM) | Auth checks & Directory Traversal |
| 2734675 | SAP Cash Management | Missing Authorization Checks |
| 2730227 | SAP Central Payments | Missing Authorization Checks |
Frequently Asked Questions
What is the purpose of the corrections in Note 2871877?
The corrections in Note 2871877 are designed to patch high-priority vulnerabilities in SAP EAM MRO Workbenches, specifically preventing unauthorized privilege escalation and directory traversal attacks that could compromise file integrity.
Which function modules are secured by Note 2734675?
Note 2734675 secures function modules BAPIFCLMBAMAMDBNKANT and BAPIHOUSEBANK_REPLICATE, which are used for replicating Bank Account Management master data in SAP S/4HANA Finance.
Is SAP Central Payments affected by these updates?
Yes, Note 2730227 addresses missing authorization checks in the historical data processing component of SAP Central Payments, which is part of the SAP Central Finance solution.