CERT-In Vulnerability Note
CIVN-2023-0074
Multiple Vulnerabilities in SAP Products
Original Issue Date:March 14, 2023
Severity Rating: HIGH
Software Affected
- SAP Business Objects Business Intelligence Platform (CMC),Versions¿420, 430
- SAP NetWeaver AS for Java,Version ¿7.50
- SAP NetWeaver Application Server for ABAP and ABAP Platform, Versions -700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791
- SAP NetWeaver AS for ABAP and ABAP Platform (SAPRSBRO Program), Versions ¿700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757
- SAP Business Objects (Adaptive Job Server), Versions ¿420, 430
- SAP Solution Manager and ABAP managed systems(ST-PI), Versions -2008_1_700, 2008_1_710and 740
- SAP Host Agent, Versions ¿7.22
- SAP NetWeaver(SAP Enterprise Portal), Versions ¿7.50
- SAPABAP Platform,Versions -751, 753, 753, 754, 756, 757, 79
- SAP BusinessObjects Business Intelligence Platform (Web Services), Versions ¿420, 430
- SAP Content Server,Version ¿7.5
- SAP Authenticator for Android, Version ¿1.3.0
- SAP NetWeaver,Versions¿700, 701, 702, 731, 740, 750
- SAP NetWeaver AS Java (Object Analyzing Service),Versions¿7.50
Overview
Multiple vulnerabilities have been reported in SAP Products which could allow an attacker to escalate privileges, inject arbitrary code, disclose sensitive information, allow unrestricted file uploads, perform DoS attacks, allow an unauthorized user to start a restricted transaction, perform Cross site scripting (XSS) attacks, redirect users to arbitrary URL and bypass security restrictions on the targeted system.
Description
These vulnerabilities exist in SAP Products due to Code Injection vulnerability in SAP Business Objects Business Intelligence Platform (CMC), Improper Access Control in SAP NetWeaver AS for Java and NetWeaver AS Java (Classload Service), Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform and SAP ERP and S4HANA (SAPRSBRO Program), OS command execution vulnerability in SAP Business Objects Business Intelligence Platform (Adaptive Job Server), Arbitrary Code Execution in SAP Solution Manager and ABAP managed systems (ST-PI), Multiple vulnerabilities in SAP NetWeaver AS for ABAP and ABAP Platform and SAP BusinessObjects Business Intelligence platform, Memory Corruption vulnerability in SAPOSCOL, XXE vulnerability in SAP NetWeaver(SAP Enterprise Portal), SQL Injection vulnerability in ABAP Platform, Denial of Service (DoS) in SAP NetWeaver AS for ABAP and ABAP Platform, Cross-Site Scripting (XSS) vulnerability in SAP Content Server and SAP NetWeaver, Information Disclosure vulnerability in SAP Authenticator for Android, Missing Authentication and Authorization check in SAP NetWeaver AS Java (Object Analyzing Service) and Missing Authentication check in SAP NetWeaver AS for Java (Cache Management Service).
Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges, inject arbitrary code, disclose sensitive information, allow unrestricted file uploads, perform DoS attack, allow an unauthorized user to start a restricted transaction, perform Cross site scripting (XSS) attacks, redirect users to arbitrary URL and bypass security restrictions on the targeted system.
Solution
Apply appropriate fixes as mentioned in SAP Security Advisory:
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
Vendor Information
SAP
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
References
SAP
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE Name
CVE-2023-25616
CVE-2023-23857
CVE-2023-27269
CVE-2023-27500
CVE-2023-25617
CVE-2023-27893
CVE-2023-27501
CVE-2023-26459
CVE-2023-25618
CVE-2023-27498
CVE-2023-26461
CVE-2023-25615
CVE-2023-27270
CVE-2023-27271
CVE-2023-27896
CVE-2023-27894
CVE-2023-24526
CVE-2023-26457
CVE-2023-27895
CVE-2023-0021
CVE-2023-27268
CVE-2023-26460
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|