- 206/2022
- High
SAP has released security updates to address several vulnerabilities affecting multiple products. In addition, SAP also announced (5) updates to the previously released patch day security note.
This month’s patch fixes several vulnerabilities affecting multiple SAP products such as SAP Business One, SAP BusinessObjects Business Intelligence Platform, SAP Access Control, SAP NetWeaver Enterprise Portal (KMC), SAP Knowledge Warehouse, SAP SuccessFactors attachment API for Mobile Application (Android &iOS), and SAP Business Client. The remote attacker could exploit some of these vulnerabilities to take control of the affected system.
Sample of the addressed vulnerabilities:
1. Windows Unquoted Service Path issue in SAP Business One – (CVE-2022- 35292):
- CVSS: 7.8
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Consequences: Gain Privileges
2. Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (CMC) – (CVE-2022-39014):
- CVSS: 7.7
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Consequences: Obtain Information
Vulnerabilities
SAP September 2022 Security Patch Day Excel Sheet Attached
Mitigations
The enterprise should deploy this patch as soon as the testing phase is completed.