Skip to main content

SAP Releases May 2022 Security Updates

Scheduled updates for SAP products

Threat ID:
CC-4094
Threat Severity:
Information only
Published:
17 May 2022 11:17 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Scheduled updates for SAP products

The following platforms are also known to be affected:

  • SAP Commerce
  • SAP Customer Profitability Analytics
  • SAP Employee Self Service
  • SAP Host Agent
  • SAP Webdispatcher

Threat details

Introduction

SAP has released security updates to address eleven vulnerabilities, which are covered in eight new security notes and four updates to previous notes. One of the vulnerabilities is CVE-2022-22965, the critical Spring Framework vulnerability that affects multiple SAP products. An unauthenticated remote attacker could exploit some of these vulnerabilities to take control of an affected system.

Remediation advice

Affected organisations are encouraged to review the SAP Security Notes for May 2022 and apply the necessary updates.

CVE Vulnerabilities

Status Published

CVE-2022-22534

Due to insufficient encoding of user input, SAP NetWeaver allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password. These endpoints are normally exposed over the network and successful exploitation can partially impact confidentiality of the application.
Status Published

CVE-2022-22541

SAP BusinessObjects Business Intelligence Platform - versions 420, 430, may allow legitimate users to access information they shouldn't see through relational or OLAP connections. The main impact is the disclosure of company data to people that shouldn't or don't need to have access.
Status Published

CVE-2022-22965

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
Status Published

CVE-2022-27656

The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Status Published

CVE-2022-28214

During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems’ Confidentiality, Integrity, and Availability.
Status Published

CVE-2022-28215

SAP NetWeaver ABAP Server and ABAP Platform - versions 740, 750, 787, allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL validation. This could lead to the user being tricked to disclose personal information.
Status Published

CVE-2022-28774

Under certain conditions, the SAP Host Agent logfile shows information which would otherwise be restricted.
Status Published

CVE-2022-29610

SAP NetWeaver Application Server ABAP allows an authenticated attacker to upload malicious files and delete (theme) data, which could result in Stored Cross-Site Scripting (XSS) attack.
Status Published

CVE-2022-29611

SAP NetWeaver Application Server for ABAP and ABAP Platform do not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
Status Published

CVE-2022-29613

Due to insufficient input validation, SAP Employee Self Service allows an authenticated attacker with user privileges to alter employee number. On successful exploitation, the attacker can view personal details of other users causing a limited impact on confidentiality of the application.
Status Published

CVE-2022-29616

SAP Host Agent, SAP NetWeaver and ABAP Platform allow an attacker to leverage logical errors in memory management to cause a memory corruption.

Last edited: 17 May 2022 11:17 am