Description:

SAP has released a security updates to address multiple vulnerabilities in the following products:

• SAP Web Dispatcher, Versions - 7.49, 7.53, 7.77, 7.81, 7.85, 7.22EXT, 7.86, 7.87
• SAP Content Server, Version - 7.53
• SAP NetWeaver and ABAP Platform, Versions - KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT, 7.49
• SAP Commerce, Versions - 1905, 2005, 2105, 2011
• SAP Data Intelligence, Version - 3
• Internet of Things Edge Platform, Version - 4.0
• SAP Customer Checkout, Version - 2
• SAP Business Client, Version – 6.5
• SAP Solution Manager (Diagnostics Root Cause Analysis Tools), Version - 720
• SAP S/4HANA, Versions - 100, 101, 102, 103, 104, 105, 106
• SAP NetWeaver Application Server Java, Versions - KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53
• SAP NetWeaver AS ABAP (Workplace Server), Versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 787
• SAP NetWeaver (ABAP and Java application Servers), Versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756
• SAP ERP HCM (Portugal), Versions - 600, 604, 608
• SAP Business Objects Web Intelligence (BI Launchpad) , Version - 420
• SAP 3D Visual Enterprise Viewer , Version - 9.0
• SAP Adaptive Server Enterprise , Version - 16.0
• SAP S/4HANA (Supplier Factsheet and Enterprise Search for Business Partner, Supplier and Customer) , Versions - 104, 105, 106
• SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel) , Versions - KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT, 7.49

Threats:

Attacker could exploit these vulnerabilities by doing the following:

• Cross-site scripting (XSS)
• Code Injection
• Execute arbitrary code
• Directory Traversal
• Denial of service attack (DoS)

Best practice and Recommendations:

The CERT team encourages users to review SAP security advisory and apply the necessary updates:

• https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+February+2022