SAP Security Notes – December 2022

On the 13th of December 2022, SAP Security Patch Day saw the release of 15 new Security Notes.

There was 3 update to previously released Patch Day Security Notes. 

Notes by severity

Highlights

On December Patch Day, the last one for this year, SAP presents 9 high-severity Notes with 5 of them rated as HotNews. Please see our overview on these. 

Starting the list of HotNews for today, we have 2622660 Security Note – Security updates for the browser control Google Chromium delivered with SAP Business Client with a CVSS Score of 10. With the added new iteration of an update to the list of support packages, this Note solution should be considered essential to implement.

Any file on Business Objects server could be replaced or edited even with user privileges through the vulnerability described in the Note 3239475 – Server-Side Request Forgery vulnerability in SAP BusinessObjects Business Intelligence Platform. With a CVSS Score of 9.9, the solution steps presented in this Note must be overviewed as the BOBJ is the standard part of client environments. Another Note dedicated to BOBJ security is 3229132 – Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (CVSS Score of 8.2) – the Note was re-released with updated solution information about suitable workarounds.

SAP Commerce receives two security patches today: Security Note 3271523 – Remote Code Execution vulnerability associated with Apache Commons Text (CVSS Score of 9.8). Apache Commons Text versions could become the target for malicious remote code execution without the presented solution. The next is Security Note 3248255 with a CVSS Score of 8.0. It describes the vulnerability based on the inputs from untrusted sources, which could be leveraged by an attacker to execute a DOM Cross-Site Scripting (XSS) attack.

User Defined Search and Messaging System of SAP NetWeaver get the specific mitigation steps this Patch Day: Note 3267780 – Improper access control in SAP NetWeaver Process Integration (CVSS Score of 9.4). Another HotNews patch brought to life is 3273480 Security Note – Improper access control in SAP NetWeaver Process Integration with a CVSS Score of 9.9.

For SAP BASIS: Note 3268172 – Code Injection vulnerability in SAP BASIS with CVSS Score of 8.8. An attacker could execute any of its public methods with any desirable parameters using the access system class through the unrestricted scope of the RFC function module.

The last to cover in our digest is Note 3271091 – Privilege escalation vulnerability in SAP Business Planning and Consolidation (CVSS Score of 8.5). Through the usage of transaction codes reserved for customer, an attacker could obtain the benefit of unauthorised transaction functionality for the further escalation of privileges.

Summary