CERT-In Advisory
CIAD-2019-0025
Multiple Vulnerabilities in SAP Systems
Original Issue Date: August 05, 2019
Severity Rating: High
Systems Affected
- SAP Diagnostic Agent (LM-Service) version 7.20
- SAP NetWeaver Process Integration ABAP tests (SAP Basis) versions 7.0, 7.1, 7.3, 7.31, 7.4, 7.5
- SAP Commerce Cloud (ex SAP Hybris Commerce) (HY_COM versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811
- OpenUI5 versions prior to 1.38.39
- OpenUI5 versions prior to 1.44.39
- OpenUI5 versions prior to 1.52.25
- OpenUI5 versions prior to 1.60.6
- OpenUI5 versions prior to 1.63.0
- SAP Information Steward versions 4.2
- ABAP Server and ABAP Platform (SAP Basis) versions 7.31, 7.4, 7.5
- SAP BusinessObjects Business Intelligence Platform (BI Workspace) (Enterprise) versions 4.1, 4.2, 4.3
- SAP NetWeaver for Java Application Server (Web Container) versions engine api (7.1, 7.2, 7.3, 7.31, 7.4 and 7.5), servercode (7.2, 7.3, 7.31, 7.4, 7.5)
- SAP ERP HCM (SAP_HRCES) versions 3
- SAP NetWeaver Application Server for Java (Startup Framework) versions 7.21, 7.22, 7.45, 7.49, and 7.53
- SAP Gateway versions 7.5, 7.51, 7.52 and 7.53
Overview
Multiple vulnerabilities have been reported in SAP Systems, which could be exploited by an attacker to execute code, obtain sensitive information, perform cross site scripting attacks, or cause denial of service conditions.
Description
Multiple vulnerabilities exist in SAP Systems due to improper handling of user supplied input. A remote attacker could exploit these vulnerabilities to inject code that can be executed by the application , execute OS commands with privileged rights, prevent authenticated users to access a service by crashing or flooding the service, conduct cross-site scripting attacks, allow the attacker to upload files without proper validation, obtain access to sensitive information, or perform content injection attacks.
Solution
Apply appropriate patch as mentioned on SAPs website
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575
Vendor Information
SAP
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575
References
SAP
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575
Onapsis
https://www.onapsis.com/blog/sap-patch-notes-july-2019
Security Affairs
https://securityaffairs.co/wordpress/88396/security/sap-security-notes-july-2019.html
CVE Name
CVE-2019-0330
CVE-2019-0328
CVE-2019-0322
CVE-2019-0281
CVE-2019-0329
CVE-2019-0321
CVE-2019-0326
CVE-2019-0327
CVE-2019-0325
CVE-2019-0318
CVE-2019-0319
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|