SAP has released security updates to address multiple vulnerabilities in the following products:

• SAP Web Dispatcher,
  • 7.49, 7.53, 7.77, 7.81, 7.85, 7.22EXT, 7.86, 7.87
• SAP Content Server
  • 7.53
• SAP NetWeaver and ABAP Platform
  • 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53,
• KRNL64NUC
  • 7.22, 7.22EXT, 7.49
• SAP Work Manager
  • 6.4, 6.5, 6.6
• SAP Inventory Manager
  • 4.3, 4.4
• Fiori Launchpad,
  • 754, 755, 756
• SAP-JEE
  • 6.40
• SAP-JEECOR
  • 6.40, 7.00, 7.01
• SERVERCORE
  • 7.10, 7.11, 7.20, 7.30, 7.31
• SAPS/4HANA (Supplier Factsheet and Enterprise Search for Business Partner, Supplier and Customer)
  • 104, 105, 106
• SAP NetWeaver Enterprise Portal
  • 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50
• SAP NetWeaver Enterprise Portal
  • 7.30, 7.31, 7.40, 7.50
• SAP Financial Consolidation
  • 10.1
• SAP NetWeaver Application Server for ABAP
  • 700, 701, 702, 731
• SAP Focused Run,
  • 200, 300
• Simple Diagnostics Agent,
  • =>1.0, < 1.58
• SAP Business Objects Business Intelligence Platform
  • 420, 430
• SAPCAR
  • 7.22
• SAP NetWeaver AS JAVA (Portal Basis),
  • 7.50
• SAP Web Dispatcher,
  • 7.49, 7.53, 7.77, 7.81, 7.85, 7.22EXT, 7.86, 7.87
• AP Content Server
  • 7.53
• SAP NetWeaver and ABAP Platform
  • KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87
  • KRNL64UC 8.04, 7.22, 7.22
  • EXT, 7.49, 7.53
  • KRNL64
  • NUC 7.22, 7.22
  • EXT, 7.49
  • SAP Commerce
  • 1905, 2005, 2105, 2011
• SAP Data Intelligence
  • 3
• SAP Dynamic Authorization Management
  • 9.1.0.0, 2021.03
• Internet of Things Edge Platform
  • 4.0
• SAP Customer Checkout
  • 2
• SAP Business Client
  • 6.5
• SAP Solution Manager (Diagnostics Root Cause Analysis Tools)
  • 720
• SAPS/4HANA
  • 100, 101, 102, 103, 104, 105, 106
• SAP NetWeaver Application Server Java
  • KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53
• SAP NetWeaverASABAP (Workplace Server)
  • 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 787
• SAP NetWeaver (ABAP and Java application Servers)
  • 700, 701, 702, 731, 740, 750, 751,752, 753, 754, 755, 756
• SAPERPHCM(Portugal)
  • 600, 604, 608
• SAP Business Objects Web Intelligence (BI Launchpad)
  • 420
• SAP 3D Visual Enterprise Viewer
  • 9.0
• SAP Adaptive Server Enterprise
  • 16.0
• SAPS/4HANA(Supplier Factsheet and Enterprise Search for Business Partner, Supplier and Customer)
  • 104, 105, 106
• SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel)
  • KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT, 7.49

Attacker could exploit these vulnerabilities by doing the following:

• Cross-site scripting (XSS)
• Code Injection
• Execute arbitrary code
• Directory Traversal
• Denial of service attack (DoS)

The CERT team encourages users to review SAP security advisory and apply the necessary updates:

• https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a&rc=10