SAP Security Patch Day: Updates released for 15 vulnerabilities, 8 of them are critical

SAP security teams have revealed the finding of at least 15 vulnerabilities discovered in some of their products. The company recommends that customers verify the presence of these flaws and update their products if necessary.

360 Mobile Vision - 360mobilevision.com North & South Carolina Security products and Systems Installations for Commercial and Residential - $55 Hourly Rate. ACCESS CONTROL, INTRUSION ALARM, ACCESS CONTROLLED GATES, INTERCOMS AND CCTV INSTALL OR REPAIR 360 Mobile Vision - 360mobilevision.com is committed to excellence in every aspect of our business. We uphold a standard of integrity bound by fairness, honesty and personal responsibility. Our distinction is the quality of service we bring to our customers. Accurate knowledge of our trade combined with ability is what makes us true professionals. Above all, we are watchful of our customers interests, and make their concerns the basis of our business.

These vulnerabilities were detected and reported between March and August 2020.

SAP Security Patch Day: Updates released for 15 vulnerabilities, 8 of them are critical

Below is a brief summary of the reported flaws, in addition to their identification keys according to the Common Vulnerability Scoring System (CVSS).

  • CVE-2020-6287: Multiple flaws in SAP NetWeaver AS JAVA (LM Configuration Wizard)
  • CVE-2020-6284: Cross-Site script vulnerability (XSS) in SAP Netweaver
  • CVE-2020-6294: No authentication verification on SAP BusinessObjects Business Intelligence platform
  • CVE-2020-6298: Missing authorization check in SAP Banking Services
  • CVE-2020-6296: Code injection vulnerability in SAP NetWeaver and the ABAP platform
  • CVE-2020-6309: No authentication verification in SAP NetWeaver AS JAVA
  • CVE-2020-6293: No file upload controls on SAP NetWeaver
  • CVE-2020-6295: Information disclosure vulnerability in SAP Adaptive Server Enterprise
  • CVE-2020-6297: Information disclosure vulnerability in SAP Data Intelligence
  • CVE-2020-11022, CVE-2020-11023: Cross-Site scripting vulnerabilities (XSS) in jQuery, included with SAPUI5
  • CVE-2020-9281, CVE-2019-11358: Two vulnerabilities in open source libraries used in SAP Commerce
  • CVE-2020-6301: No authorization check in SAP ERP
  • CVE-2020-6300: Cross-Site scripting vulnerability (XSS) on SAP Business Objects Business Intelligence Platform
  • CVE-2020-6273: No authorization check in SAP S/4 HANA
  • CVE-2020-6299: Information disclosure vulnerability in SAP NetWeaver and the ABAP Platform
  • CVE-2020-6310: Information disclosure flaw in SAP NetWeaver and ABAP platform

As can be seen, most of these flaws relate to cross-site scripting (XSS) attacks and sensitive information exposure. The most severe of these vulnerabilities (CVE-2020-6287) received a CVSS score of 10/10, so it is considered a critical flaw. The next 7 flaws received scores between 9/10 and 8/10. The score for the rest of the reports ranges from 3/10 to 4/10.

Customers who want to learn more about reported flaws can view the full report on SAP’s official platforms. Updates should be installed as soon as possible to fully mitigate any attempts to exploit.

The post SAP Security Patch Day: Updates released for 15 vulnerabilities, 8 of them are critical appeared first on Cyber Security News | Exploit One | Hacking News.

By admin