Description:

SAP has released security update to address multiple vulnerabilities in the following products:

• SAP Commerce
  • 6.6, 6.7, 1808, 1811, 1905
• SAP Diagnostic Agent (LM-Service)
  • 7.20
• SAP NetWeaver (Knowledge Management)
  • KMC-CM - 7.00, 7.01, 7.02, 7.30, 7.31, 7.40, 7.50
  • KMC-WPC – 7.30, 7.31, 7.40, 7.50
• SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer)
  • 4.1, 4.2
• SAP OrientDB
  • 3.0
• SAP Solution Manager (Diagnostics Agent)
  • 7.2
• SAP Business Objects Business Intelligence Platform (Crystal Reports)
  • 4.1, 4.2, 4.3
• SAP Host Agent
  • 7.21
• SAP Landscape Management
  • 3.0
• SAP Adaptive Extensions
  • 1.0
• SAP ERP
  • 618, 730, EAPPLGLO 607
• SAP S/4 HANA
  • 100, 101, 102, 103, 104

SAP NetWeaver AS Java (HTTP Service)

• • 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50
• SAP Business Objects Business Intelligence Platform (BI Launchpad)
  • 4.2
• SAP NetWeaver AS ABAP (Business Server Pages Test Application IT00)
  • 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754
• SAP NetWeaver AS ABAP (Business Server Pages Test Application SBSPEXT_PHTMLB)
  • 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754
• SAP NetWeaver AS ABAP (Business Server Pages application CRM_BSP_FRAME)
  • 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E
• SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface)
  • 4.1, 4.2
• SAP Business Client
  • 6.5, 7.0
• SAP Business Objects Business Intelligence Platform (CMS / Auditing issues)
  • 4.2
• SAP Fiori Launchpad
  • 753, 754
• SAP S/4HANA (Financial Products Subledger)
  • FSAPPL 400, 450, 500; S4FPSL 100, 100

Threats:

Attacker could exploit these vulnerabilities by doing the following:

• Missing Authorization Check.
• Missing XML Validation
• Code Injection
• Information Disclosure
• Cross-site scripting (XSS) attack.

Best practice and Recommendations:

The CERT team encourages users to review SAP security advisory and apply the necessary updates:

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202