SAP© Security Advisories - 06 2020 - SecurityBridge Cloud Platform

We've created the first of its kind, SecurityBridge Cloud Platform, designed to prioritize SAP patches, updates, and remediation strategies that help prevent disruptions to critical business systems. Our security advisories provide SAP users with valuable insights into the security and business implications of operating SAP.

The user interface is designed to be as intuitive as possible, but we’d love to hear your feedback and suggestions.
We hope you enjoy using it!

× Yikes, there is work to do!
This time we found critical correction advisiories. We count 18 and the highest CVSS score is 9.8.

Severity

SAP© Security advisories 18

System Types

Affected SAP© system types

_{Related note}
2916562

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
[CVE-2020-6270] Missing Authorization check in SAP Netweaver AS ABAP (Banking Services)

Security Advisory

_{Related note}
2540180

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
Switchable Authorization checks for RFC in Environment, Health & Safety

Security Advisory

_{Related note}
2918762

_CVSS
6.5

_{Affected system
type}
Adobe LiveCycle Designer

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
Multiple vulnerabilities in Adobe LiveCycle Designer 11.0

Security Advisory

_{Related note}
2918924

_CVSS
9.8

_{Affected system
type}
SAP Cloud Commerce

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
[CVE-2020-6265] Use of Hard-coded Credentials in SAP Commerce and SAP Commerce Datahub

Security Advisory

_{Related note}
2908382

_CVSS
4.4

_{Affected system
type}
SAP Business One

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
[CVE-2020-6239] Information Disclosure in SAP Business One (Backup Service)

Security Advisory

_{Related note}
2911267

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
Update 1 to Security Note 2752614 - [CVE-2019-0319] Content Injection Vulnerability in SAP Gateway

Security Advisory

_{Related note}
2911687

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
[CVE-2020-6266] URL redirection in SAP Fiori for SAP S/4HANA

Security Advisory

_{Related note}
2905836

_CVSS
4.3

_{Affected system
type}
BI/BO platform

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
[CVE-2020-6269] Information Disclosure in SAP Business Objects Business Intelligence Platform

Security Advisory

_{Related note}
2911704

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
[CVE-2020-6266] URL redirection in SAP Fiori for SAP S/4HANA

Security Advisory

_{Related note}
2915126

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
[CVE-2020-6260] Incomplete XML Validation in SAP Solution Manager (Trace Analysis)

Security Advisory

_{Related note}
2906366

_CVSS
8.6

_{Affected system
type}
SAP Cloud Commerce

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
[CVE-2020-6264] Information Disclosure in SAP Commerce

Security Advisory

_{Related note}
2906996

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
[CVE-2020-6268] Missing authorization check in SAP ERP (Statutory Reporting for Insurance Companies)

Security Advisory

_{Related note}
2923035

_CVSS
4.4

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI

Security Advisory

_{Related note}
2931391

_CVSS
8.2

_{Affected system
type}
Java

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
[CVE-2020-6271] Missing XML Validation in SAP Solution Manager (Problem Context Manager)

Security Advisory

_{Related note}
2928570

_CVSS
9.8

_{Affected system
type}
Java

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
Ghostcat' Apache Tomcat AJP Vulnerability in SAP Liquidity Management for Banking

Security Advisory

_{Related note}
2878568

_CVSS
6.9

_{Affected system
type}
Java

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
[CVE-2020-6263] Authentication Bypass in Standalone Clients connecting to SAP NetWeaver AS Java via P4 Protocol

Security Advisory

_{Related note}
2912939

_CVSS
7.6

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
[CVE-2020-6275] Server Side Request Forgery vulnerability in SAP NetWeaver AS ABAP

Security Advisory

_{Related note}
2878935

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
[CVE-2020-6246] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP ( Business Server Pages Test Application SBSPEXT_TABLE)

Security Advisory

Notifications

Severity

SAP© Security advisories 18

System Types

Affected SAP© system types

Related note 2916562

CVSS 6.5

Affected system type ABAP

Patchday2020-06

Released on2020/06/09

Related note 2540180

CVSS 6.3

Affected system type ABAP

Patchday2020-06

Released on2020/06/09

Related note 2918762

CVSS 6.5

Affected system type Adobe LiveCycle Designer

Patchday2020-06

Released on2020/06/09

Related note 2918924

CVSS 9.8

Affected system type SAP Cloud Commerce

Patchday2020-06

Released on2020/06/09

Related note 2908382

CVSS 4.4

Affected system type SAP Business One

Patchday2020-06

Released on2020/06/09

Related note 2911267

CVSS 4.3

Affected system type ABAP

Patchday2020-06

Released on2020/06/09

Related note 2911687

CVSS 5.4

Affected system type ABAP

Patchday2020-06

Released on2020/06/09

Related note 2905836

CVSS 4.3

Affected system type BI/BO platform

Patchday2020-06

Released on2020/06/09

Related note 2911704

CVSS 5.4

Affected system type ABAP

Patchday2020-06

Released on2020/06/09

Related note 2915126

CVSS 6.5

Affected system type Java

Patchday2020-06

Released on2020/06/09

Related note 2906366

CVSS 8.6

Affected system type SAP Cloud Commerce

Patchday2020-06

Released on2020/06/09

Related note 2906996

CVSS 5.4

Affected system type ABAP

Patchday2020-06

Released on2020/06/09

Related note 2923035

CVSS 4.4

Affected system type ABAP

Patchday2020-06

Released on2020/06/09

Related note 2931391

CVSS 8.2

Affected system type Java

Patchday2020-06

Released on2020/06/09

Related note 2928570

CVSS 9.8

Affected system type Java

Patchday2020-06

Released on2020/06/09

_{Related note}
2916562

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

_{Related note}
2540180

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

_{Related note}
2918762

_CVSS
6.5

_{Affected system
type}
Adobe LiveCycle Designer

_Patchday
2020-06

_{Released
on}
2020/06/09

_{Related note}
2918924

_CVSS
9.8

_{Affected system
type}
SAP Cloud Commerce

_Patchday
2020-06

_{Released
on}
2020/06/09

_{Related note}
2908382

_CVSS
4.4

_{Affected system
type}
SAP Business One

_Patchday
2020-06

_{Released
on}
2020/06/09

_{Related note}
2911267

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

_{Related note}
2911687

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

_{Related note}
2905836

_CVSS
4.3

_{Affected system
type}
BI/BO platform

_Patchday
2020-06

_{Released
on}
2020/06/09

_{Related note}
2911704

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

_{Related note}
2915126

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2020-06

_{Released
on}
2020/06/09

_{Related note}
2906366

_CVSS
8.6

_{Affected system
type}
SAP Cloud Commerce

_Patchday
2020-06

_{Released
on}
2020/06/09

_{Related note}
2906996

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

_{Related note}
2923035

_CVSS
4.4

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

_{Related note}
2931391

_CVSS
8.2

_{Affected system
type}
Java

_Patchday
2020-06

_{Released
on}
2020/06/09

_{Related note}
2928570

_CVSS
9.8

_{Affected system
type}
Java

_Patchday
2020-06

_{Released
on}
2020/06/09

_{Related note}
2878568

_CVSS
6.9

_{Affected system
type}
Java

_Patchday
2020-06

_{Released
on}
2020/06/09