- 232/2022
- Critical
SAP has released security updates to address several vulnerabilities affecting multiple products. In addition, SAP also announced (2) updates to the previously released patch day security note.
This month’s patch fixes several vulnerabilities affecting multiple SAP products such as SAP Manufacturing Execution, SAP Commerce, and SAP BusinessObjects Business Intelligence Platform. The remote attacker could exploit some of these vulnerabilities to take control of the affected system.
Samples of the addressed vulnerabilities:
1. SAP Manufacturing Execution directory traversal (CVE-2022-39802):
- CVSS: 9.9
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Consequences: Obtain Information
2. SAP Commerce security bypass (CVE-2022-41204):
- CVSS: 9.6
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Consequences: Bypass Security
Vulnerabilities
List of vulnerabilities could be found in the below link:
Mitigations
The enterprise should deploy this patch as soon as the testing phase is completed.