Thomas Fritsch
As a key SAP security researcher at Onapsis, Thomas Fritsch is a trusted authority on vulnerability management and emerging threats. Leveraging his extensive career as an SAP expert, he focuses on deeply technical areas like SAP system configuration and transport management. Thomas’s analysis of the latest SAP security patches and vulnerabilities is a core component of the research that provides the in-depth, actionable intelligence organizations need to protect their systems. His role as a respected speaker and publisher further establishes him as a definitive voice in the SAP cybersecurity space, helping to bridge the gap between complex research and real-world security practices.
SAP Security Patch Day: July 2023
Important Patches for IS-OIL, Solution Manager, Web Dispatcher, and ICM
How to Securely Introduce Explicit AUTHORITY-CHECKS into Custom RFC-Enabled Function Modules
SAP customers often rely only on S_RFC authorizations to protect access to business data via RFC-enabled function modules (RFC FMs). This is risky because, due to the complexity of business scenarios, S_RFC authorizations are often assigned very generically (RFC_NAME = ‘*’ ). Another reason that S_RFC authorizations lack granularity is because in the past S_RFC authorizations could only be restricted on a function group level.
SAP Security Patch Day: May 2023
Highlights of May SAP Security Notes analysis include twenty-five new and updated SAP security patches released, including three HotNews Notes and nine High Priority Notes. Several critical vulnerabilities in SAP 3D Visual Enterprise License Manager’s web interface should be paid close attention. This month also marks the fourth time in a row that Onapsis Research Labs has directly contributed to SAP Patch Tuesday.
SAP Security Patch Day: April 2023
Critical Vulnerabilities in SAP Diagnostics Agent Poses Risk To All SAP Systems
SAP Patch Day: March 2023
Critical Vulnerabilities patched in SAP NetWeaver AS ABAP / Java and in SAP BusinessObjects
Using Generic Application Access Rules in SAP Custom Development
SAP applications often require the need to restrict access for certain entities to a subset of all instances. In most scenarios, SAP’s authorization concept is sufficient for this purpose. However, there are some disadvantages using SAP authorizations: Developers can eliminate these disadvantages by integrating allowlists into business processes. By assigning an appropriate delivery class to…
SAP Patch Day: February 2023
SAP Patch Day for February 2023 addresses twenty-six new & updated security patches which include one HotNews Note & five High Priority Notes.
SAP Patch Day: January 2023
SAP patch day for January 2023 addresses critical vulnerabilities patched for SAP AS ABAP and Java.
A Look Back at SAP Vulnerabilities in 2022
Onapsis Research Labs shares some of the top SAP security vulnerabilities organizations should be aware of from 2022.