SAP^® Security Advisories

Arbitrary execution of RFC functions through SDF-CCM_AGS_CC_SIM_API_LOAD Impact on Business This vulnerability allows an attacker to execute any function that exists in the system, therefore if there is, for example, a function that can delete/overwrite files or execute operating system commands, this could be affected from the business to a denial of service. Vulnerability Details…

XXE vulnerability in SAP NetWeaver AS Java – Guided Procedures Impact On Business Successful attacks impact the confidentiality of the SAP Netweaver JAVA as well as being able to perform SSRF or retrieve files. Vulnerability Details The servlet caf~eu~gp~model~iforms~eap in SAP Netweaver JAVA, resolving external entities during the parsing of the fromprocessor XML response. Attackers…

Memory Corruption vulnerability in SAP CommonCryptoLib Impact On Business A manipulated data package with a corrupted SNC NAME ASN.1 structure can lead to a parser error and a crash of the application. Vulnerability Details A memory corruption vulnerability exists for sec1_gss_import_name() in libsapcrypto.so library. The function trusts the incoming size parameter for a specific option….

Stored XSS in administration UI of SAP Impact On Business Impact depends on the victim privileges, but SAP Webdispatcher access is generally granted to administrator users. In the worst case, a successful attack allows an attacker to force an administrator to perform actions on SAP Webdispatcher, like exfiltrate data, change data or shutdown the Webdispatcher….

Arbitrary execution of RFC functions through CCM_AGS_CC_SIM_API_START Impact On Business This vulnerability allows an attacker to execute any function that exists in the system, therefore if there is, for example, a function that can delete/overwrite files or execute operating system commands, this could be affected from the business to a denial of service. Affected Components…

Directory Traversal vulnerability in SAP NetWeaver (BI_CONT Add-On) Impact On Business An authenticated attacker with high privileges can leverage a directory traversal flaw to overwrite a file which is otherwise restricted. On successful exploitation an attacker can compromise the availability and integrity of the system. Affected Components Description SAP NetWeaver AS for ABAP and ABAP…

MS_ACL_INFO bypass under special conditions Impact On Business The Message Server is a central component of every SAP system. When, certain conditions are met (listed in a further section) the ACL INFO stops working and therefore any unauthenticated attacker can register new application servers (10Kblaze attack). Affected Components Description Every Message Server binary between SAP…

Unauthenticated blind SSRF in SmdSapHostAgentBridge Impact On Business An anonymous attacker with access to the P4 port of the Java instance of a Solution Manager, could force the Diagnostic Agent to perform arbitrary server side requests. As a consequence, internal infrastructure could be affected leveraging the network position. Affected Components Description Tested on following versions:…

Unauthenticated blind SSRF in SAPGrmgClassicCollector Impact On Business An anonymous attacker with access to the P4 port of the Java instance of a Solution Manager, could force the Diagnostic Agent to perform arbitrary server side requests. As a consequence, internal infrastructure could be affected leveraging the network position. Affected Components Description Tested on following versions:…