SAP® and Oracle® Security Advisories
Onapsis Research Labs is the world’s leading team of security experts who combine their deep knowledge of critical ERP applications and decades of threat research experience to deliver impactful security insights and threat intelligence focused on the business-critical applications from SAP, Oracle, and SaaS providers. Onapsis Research Labs is, far and away, the most prolific and most celebrated contributor of vulnerability research by the SAP Product Security Response Team. No other research team comes close.
08/16/2024
Unauthenticated blind SSRF in SmdSapHostAgentBridge
Unauthenticated blind SSRF in SmdSapHostAgentBridge Impact On Business An anonymous attacker with access to the P4 port of the Java instance of a Solution Manager, could force the Diagnostic Agent to perform arbitrary server side requests. As a consequence, internal infrastructure could be affected leveraging the network position. Affected Components Description Tested on following versions:…
08/13/2024
Unauthenticated blind SSRF in SAPGrmgClassicCollector
Unauthenticated blind SSRF in SAPGrmgClassicCollector Impact On Business An anonymous attacker with access to the P4 port of the Java instance of a Solution Manager, could force the Diagnostic Agent to perform arbitrary server side requests. As a consequence, internal infrastructure could be affected leveraging the network position. Affected Components Description Tested on following versions:…
08/13/2024
Unauthenticated blind SSRF in SAPPingHTTPCollector
Unauthenticated blind SSRF in SAPPingHTTPCollector Impact On Business An anonymous attacker with access to the P4 port of the Java instance of a Solution Manager, could force the Diagnostic Agent to perform arbitrary server side requests. As a consequence, internal infrastructure could be affected leveraging the network position. Affected Components Description Tested on following versions:…
08/13/2024
Unauthenticated RCE in EventLogServiceCollector
Unauthenticated RCE in EventLogServiceCollector Impact On Business An anonymous attacker with access to the P4 port of the Java instance of a Solution Manager running on Windows OS, could execute arbitrary commands. As a consequence, despite having the possibility to fully compromise the targeted system, an attacker could leverage the network position to keep pivoting…
04/15/2024
Unauthenticated JNDI Injection in RemoteObjectFactory P4 service
Unauthenticated JNDI Injection in RemoteObjectFactory P4 service Impact On Business An unauthenticated attacker with access to the P4 port of a java-based SAP solution, would be able to exploita JNDI injection in order to be able to turn on applications. As a consequence, further attacks could be executed by leveraging flaws or features in the…
03/07/2024
Unauthenticated Information Disclosure in ObjectAnalyzer P4 service
Unauthenticated Information Disclosure in ObjectAnalyzer P4 service Impact On Business An unauthenticated attacker with access to the P4 port of a java-based SAP solution, would be able to exfiltrate sensitive technical information that could be leveraged for future attacks. This vulnerability is part of a bigger family named P4CHAINS. This group of bugs may cause…
02/01/2024
Unauthenticated Information Disclosure in CacheRegionAnalyzer P4 service
Unauthenticated Information Disclosure in CacheRegionAnalyzer P4 service Impact On Business An unauthenticated attacker with access to the P4 port of a java-based SAP solution, would be able to exfiltrate sensitive technical information that could be leveraged for future attacks. This vulnerability is part of a bigger family named P4CHAINS. This group of bugs may cause…
02/01/2024
Unauthenticated Information Disclosure in deploy P4 service
Impact On Business An unauthenticated attacker with access to the P4 port of a java-based SAP solution, would be able to exfiltrate sensitive technical information that could be leveraged for future attacks. This vulnerability is part of a bigger family named P4CHAINS. This group of bugs may cause more serious consequences and expose systems to…
01/29/2024
Unauthenticated Information Disclosure in classload P4 service
Impact On Business An unauthenticated attacker with access to the P4 port of a java-based SAP solution, would be able to exfiltrate sensitive technical information that could be leveraged for future attacks. This vulnerability is part of a bigger family named P4CHAINS. This group of bugs may cause more serious consequences and expose systems to…