SAP© Security Advisories - 03 2020 - SecurityBridge Cloud Platform

We've created the first of its kind, SecurityBridge Cloud Platform, designed to prioritize SAP patches, updates, and remediation strategies that help prevent disruptions to critical business systems. Our security advisories provide SAP users with valuable insights into the security and business implications of operating SAP.

The user interface is designed to be as intuitive as possible, but we’d love to hear your feedback and suggestions.
We hope you enjoy using it!

× Yikes, there is work to do!
This time we found critical correction advisiories. We count 20 and the highest CVSS score is 10.0.

Severity

SAP© Security advisories 20

System Types

Affected SAP© system types

_{Related note}
2884910

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2020-03

_{Released
on}
2020/03/10

Description
[CVE-2020-6205] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP Business Server Pages (Smart Forms)

Security Advisory

_{Related note}
2871167

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2020-03

_{Released
on}
2020/03/10

Description
[CVE-2020-6199] Missing Authorization check in SAP ERP and S/4 HANA (MENA Certificate Management)

Security Advisory

_{Related note}
2880664

_CVSS
5.4

_{Affected system
type}
SAP Enable Now

_Patchday
2020-03

_{Released
on}
2020/03/10

Description
[CVE-2020-6178] Insufficient session expiration in SAP Enable Now Manager

Security Advisory

_{Related note}
2731871

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-03

_{Released
on}
2020/03/10

Description
Missing Authorization check in Commercial Project Management

Security Advisory

_{Related note}
2806198

_CVSS
9.1

_{Affected system
type}
Java

_Patchday
2020-03

_{Released
on}
2020/03/10

Description
[CVE-2020-6203] Path Manipulation in SAP NetWeaver UDDI Server(Services Registry)

Security Advisory

_{Related note}
2847787

_CVSS
5.5

_{Affected system
type}
Java

_Patchday
2020-03

_{Released
on}
2020/03/10

Description
[CVE-2020-6202] Missing XML Validation in SAP NetWeaver Application Server Java (User Management Engine)

Security Advisory

_{Related note}
2864462

_CVSS
4.7

_{Affected system
type}
ABAP

_Patchday
2020-03

_{Released
on}
2020/03/10

Description
[CVE-2020-6210] Cross-Site Scripting (XSS) vulnerability in SAP Fiori Launchpad

Security Advisory

_{Related note}
1966029

_CVSS
7.3

_{Affected system
type}
ABAP

_Patchday
2020-03

_{Released
on}
2020/03/10

Description
Directory traversal in SAP Environment Health and Safety

Security Advisory

_{Related note}
2876413

_CVSS
5.4

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2020-03

_{Released
on}
2020/03/10

Description
[CVE-2020-6200] Cross-Site-Scripting in SAP Commerce Cloud (SmartEdit extension)

Security Advisory

_{Related note}
2876813

_CVSS
6.1

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2020-03

_{Released
on}
2020/03/10

Description
[CVE-2020-6201] Cross-Site Scripting (XSS) vulnerability in SAP Commerce Cloud (testweb extension)

Security Advisory

_{Related note}
2892570

_CVSS
5.9

_{Affected system
type}
ABAP Development Tools

_Patchday
2020-03

_{Released
on}
2020/03/10

Description
Missing XML Validation vulnerability in ABAP Development Tools

Security Advisory

_{Related note}
2845377

_CVSS
9.8

_{Affected system
type}
Java

_Patchday
2020-03

_{Released
on}
2020/03/10

Description
[CVE-2020-6198] Missing Authentication check in SAP Solution Manager (Diagnostics Agent)

Security Advisory

_{Related note}
2826782

_CVSS
7.5

_{Affected system
type}
BI/BO platform

_Patchday
2020-03

_{Released
on}
2020/03/10

Description
[CVE-2020-6196] Denial of service (DOS) in SAP BusinessObjects Mobile (MobileBIService)

Security Advisory

_{Related note}
2841874

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-03

_{Released
on}
2020/03/10

Description
[CVE-2020-6204] Missing Authorization check in SAP Treasury and Risk Management (Transaction Management)

Security Advisory

_{Related note}
2845363

_CVSS
3.8

_{Affected system
type}
SAP Enable Now

_Patchday
2020-03

_{Released
on}
2020/03/10

Description
[CVE-2020-6197] Insufficient session expiration in SAP Enable Now Manager

Security Advisory

_{Related note}
2858044

_CVSS
7.5

_{Affected system
type}
SAP Disclosure Management

_Patchday
2020-03

_{Released
on}
2020/03/10

Description
[CVE-2020-6209] Missing Authorization check in SAP Disclosure Management

Security Advisory

_{Related note}
2859004

_CVSS
4.7

_{Affected system
type}
SAP CPI DS

_Patchday
2020-03

_{Released
on}
2020/03/10

Description
[CVE-2020-6206] Cross-Site Request Forgery in SAP Cloud Platform Integration for data services

Security Advisory

_{Related note}
2890213

_CVSS
10.0

_{Affected system
type}
Java

Exploit available

_Patchday
2020-03

_{Released
on}
2020/03/10

Description
[CVE-2020-6207] Missing Authentication Check in SAP Solution Manager (User-Experience Monitoring)

Security Advisory

_{Related note}
2660005

_CVSS
7.2

_{Affected system
type}
SAP MaxDB

_Patchday
2020-03

_{Released
on}
2018/08/14

Description
[CVE-2018-2450] SQL Injection Vulnerability in SAP MaxDB/liveCache

Security Advisory

_{Related note}
2861301

_CVSS
8.2

_{Affected system
type}
BI/BO platform

_Patchday
2020-03

_{Released
on}
2020/03/10

Description
[CVE-2020-6208] Remote Code Execution in SAP Business Objects Business Intelligence Platform (Crystal Reports)

Security Advisory

Notifications

Severity

SAP© Security advisories 20

System Types

Affected SAP© system types

Related note 2884910

CVSS 6.1

Affected system type ABAP

Patchday2020-03

Released on2020/03/10

Related note 2871167

CVSS 5.4

Affected system type ABAP

Patchday2020-03

Released on2020/03/10

Related note 2880664

CVSS 5.4

Affected system type SAP Enable Now

Patchday2020-03

Released on2020/03/10

Related note 2731871

CVSS 6.3

Affected system type ABAP

Patchday2020-03

Released on2020/03/10

Related note 2806198

CVSS 9.1

Affected system type Java

Patchday2020-03

Released on2020/03/10

Related note 2847787

CVSS 5.5

Affected system type Java

Patchday2020-03

Released on2020/03/10

Related note 2864462

CVSS 4.7

Affected system type ABAP

Patchday2020-03

Released on2020/03/10

Related note 1966029

CVSS 7.3

Affected system type ABAP

Patchday2020-03

Released on2020/03/10

Related note 2876413

CVSS 5.4

Affected system type SAP Commerce Cloud

Patchday2020-03

Released on2020/03/10

Related note 2876813

CVSS 6.1

Affected system type SAP Commerce Cloud

Patchday2020-03

Released on2020/03/10

Related note 2892570

CVSS 5.9

Affected system type ABAP Development Tools

Patchday2020-03

Released on2020/03/10

Related note 2845377

CVSS 9.8

Affected system type Java

Patchday2020-03

Released on2020/03/10

Related note 2826782

CVSS 7.5

Affected system type BI/BO platform

Patchday2020-03

Released on2020/03/10

Related note 2841874

CVSS 4.3

Affected system type ABAP

Patchday2020-03

Released on2020/03/10

Related note 2845363

CVSS 3.8

Affected system type SAP Enable Now

Patchday2020-03

Released on2020/03/10

_{Related note}
2884910

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2020-03

_{Released
on}
2020/03/10

_{Related note}
2871167

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2020-03

_{Released
on}
2020/03/10

_{Related note}
2880664

_CVSS
5.4

_{Affected system
type}
SAP Enable Now

_Patchday
2020-03

_{Released
on}
2020/03/10

_{Related note}
2731871

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-03

_{Released
on}
2020/03/10

_{Related note}
2806198

_CVSS
9.1

_{Affected system
type}
Java

_Patchday
2020-03

_{Released
on}
2020/03/10

_{Related note}
2847787

_CVSS
5.5

_{Affected system
type}
Java

_Patchday
2020-03

_{Released
on}
2020/03/10

_{Related note}
2864462

_CVSS
4.7

_{Affected system
type}
ABAP

_Patchday
2020-03

_{Released
on}
2020/03/10

_{Related note}
1966029

_CVSS
7.3

_{Affected system
type}
ABAP

_Patchday
2020-03

_{Released
on}
2020/03/10

_{Related note}
2876413

_CVSS
5.4

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2020-03

_{Released
on}
2020/03/10

_{Related note}
2876813

_CVSS
6.1

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2020-03

_{Released
on}
2020/03/10

_{Related note}
2892570

_CVSS
5.9

_{Affected system
type}
ABAP Development Tools

_Patchday
2020-03

_{Released
on}
2020/03/10

_{Related note}
2845377

_CVSS
9.8

_{Affected system
type}
Java

_Patchday
2020-03

_{Released
on}
2020/03/10

_{Related note}
2826782

_CVSS
7.5

_{Affected system
type}
BI/BO platform

_Patchday
2020-03

_{Released
on}
2020/03/10

_{Related note}
2841874

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-03

_{Released
on}
2020/03/10

_{Related note}
2845363

_CVSS
3.8

_{Affected system
type}
SAP Enable Now

_Patchday
2020-03

_{Released
on}
2020/03/10

_{Related note}
2858044

_CVSS
7.5

_{Affected system
type}
SAP Disclosure Management

_Patchday
2020-03

_{Released
on}
2020/03/10