SAP^® Security Advisories

SAP Netweaver JAVA Enterprise Portal – Translation Worklist Authentication Insecure Deserialization Impact on Business A remote, authenticated attacker can exploit an insecure deserialization vulnerability to execute arbitrary operating system commands on the target system. This has a critical impact on the confidentiality, integrity, and availability of the system and its business applications, potentially allowing full…

SAP ADS – Overwrite arbitrary file by PDF leading to RCE Impact on Business An authenticated attacker with high privileges can exploit this vulnerability to overwrite arbitrary files on the host operating system. This can ultimately lead to remote command execution, allowing the attacker to fully compromise the confidentiality, integrity, and availability of the affected…

Unauthenticated Java Deserialization in SAP SRM Impact on Business A remote, unauthenticated attacker can exploit a Java deserialization vulnerability in SAP Supplier Relationship Management (SRM). Successful exploitation could allow the attacker to execute arbitrary commands on the operating system with the privileges of the SAP Administrator (sidadm). This has a critical impact on the confidentiality,…

Authenticated Unsecure Java Deserialization in SAP NetWeaver JAVA Enterprise Portal Federated Portal Network Impact on Business A remote, authenticated attacker with high privileges can exploit a Java deserialization vulnerability to execute arbitrary operating system commands. This can lead to a full compromise of the affected system, severely impacting the confidentiality, integrity, and availability of the…

SAP NetWeaver AS Java ILM Data Archiving Service Insecure Deserialization Impact on Business An authenticated attacker with high privileges can exploit this vulnerability to execute arbitrary operating system commands on the server. This could lead to a full compromise of the affected system, significantly impacting the confidentiality, integrity, and availability of the business application and…

SAP Netweaver JAVA – Log Viewer – Insecure JAVA Deserialization Impact on Business Successful exploitation of this vulnerability can fully compromise the SAP system. An authenticated attacker with high privileges could execute arbitrary OS commands, leading to a complete compromise of confidentiality, integrity, and availability of the affected system and its business applications. Vulnerability Details…

ABAP Command Injection in CNVCF_JSTAT_UP RFC function call (S4CORE) Impact on Business Successful exploitation of this vulnerability enables authenticated attackers to run arbitrary OS commands, resulting in full system compromise. This has a critical impact on the confidentiality, integrity, and availability of the system and its business applications. Vulnerability Details A remote-enabled function module named…

IS-OIL – OS Command Injection FM OIB_QCI_SERVER Impact On Business Successful attack could allow an attacker to execute blind operating system command as SAP System Administrator user (sidadm). Lead to full compromise the SAP Netweaver System. Vulnerability Details An OS command injection vulnerability exists in FM OIB_QCI_SERVER, delivered by OIB_QCI package and provided by IS-OIL…

SAPStartSrv – Pre-auth buffer overflow Impact On Business If parameter service/localconnection = compat : Remotely, an unauthenticated attacker could use it to execute arbitrary commands on the OS side as NT System or root users. If parameter service/localconnection is not set : Locally, an authenticated attacker with low privileges could use it to execute arbitrary…