SAP Security Notes – July 2022

On 12th of July 2022, 20 new Patch Day Security Notes were added. 3 previously released notes were also updated.

Notes by severity

HotNews — 0

Correction with high priority — 4

Correction with medium priority — 17

Correction with low priority — 2

Highlights

The most critical in this patch was the standard update of the note with CVSS Score 8.3 3221288 “[CVE-2022-35228] Information disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Central management console)”. The vulnerability allows an unauthenticated user to retrieve token information over the network to which access would otherwise be restricted. But to exploit this, an attacker needs to use methods such as sniffing or social engineering.

Several critical vulnerabilities have been closed for SAP Business One. The first of them is the Information Disclosure vulnerability through the integration script with SAP HANA in the note with CVSS Score 7.6 3212997. This note also has a Workaround that will allow you to close the vulnerability in a limited way if the system cannot be updated.

The second note 3157613 with CVSS Score 7.5 closes the Missing Authentication check vulnerability. By exploiting it, it is possible to make the application inaccessible. In this note, Workaround is possible, but you need to evaluate its applicability in your systems.

The third note 3191012 with CVSS Score 7.4 closes the Code Injection vulnerability. In this case, a user with low privileges can take control of the application. Read Solution carefully as there is no normal workaround for this vulnerability.

Summary